diff --git a/lib/engines/functest/tests/scripts/verify_driver_signed.ps1 b/lib/engines/functest/tests/scripts/verify_driver_signed.ps1
index f0e1d6e8..4ba157d1 100644
--- a/lib/engines/functest/tests/scripts/verify_driver_signed.ps1
+++ b/lib/engines/functest/tests/scripts/verify_driver_signed.ps1
@@ -1,26 +1,60 @@
-# Verify the Authenticode signature on @driver_module@.sys in the DriverStore.
-# Fails if the signature is missing or invalid.
+# Verify the Authenticode signature on @driver_module@ driver package (.sys, .cat, .inf).
+# When signtool is available, also cross-checks .sys and .inf hashes against the .cat catalog.
 
 $ErrorActionPreference = 'Stop'
 
+$module = '@driver_module@'
+$signtoolPath = '@signtool_path@'
+
 $drv = Get-WindowsDriver -Online |
-    Where-Object { $_.OriginalFileName -like '*@driver_module@.inf' } |
+    Where-Object { $_.OriginalFileName -like "*${module}.inf" } |
     Select-Object -First 1
 
-if (-not $drv) { throw '@driver_module@.inf not found in the DriverStore' }
+if (-not $drv) { throw "${module}.inf not found in the DriverStore" }
 
 $drvDir = Split-Path $drv.OriginalFileName -Parent
-$sys = Get-ChildItem $drvDir -Filter '@driver_module@.sys' | Select-Object -First 1
 
-if (-not $sys) { throw '@driver_module@.sys not found in ' + $drvDir }
+$sys = Get-ChildItem $drvDir -Filter "${module}.sys" | Select-Object -First 1
+$inf = Get-Item $drv.OriginalFileName -ErrorAction SilentlyContinue
+$catalogMatch = if ($inf) { Select-String -Path $inf.FullName -Pattern '^\s*CatalogFile(?:\.[^=]+)?\s*=\s*(.+)$' | Select-Object -First 1 } else { $null }
+$catalogName = if ($catalogMatch) { $catalogMatch.Matches[0].Groups[1].Value.Trim() } else { $null }
+$cat = if ($catalogName) { Get-ChildItem $drvDir -Filter $catalogName | Select-Object -First 1 } else { $null }
+
+if (-not $sys) { throw "${module}.sys not found in $drvDir" }
+if (-not $inf) { throw "${module}.inf not found in $drvDir" }
+if (-not $catalogName) { throw "CatalogFile entry not found in $($inf.Name)" }
+if (-not $cat) { throw "Catalog '$catalogName' not found in $drvDir" }
+
+$catSig = Get-AuthenticodeSignature $cat.FullName
+Write-Output "CAT: $($catSig.Status) - Signer: $($catSig.SignerCertificate.Subject)"
+if ($catSig.Status -ne 'Valid') {
+    throw "$($cat.Name) signature invalid: $($catSig.Status)"
+}
 
-$sig = Get-AuthenticodeSignature $sys.FullName
+$sysSig = Get-AuthenticodeSignature $sys.FullName
+Write-Output "SYS: $($sysSig.Status) - Signer: $($sysSig.SignerCertificate.Subject)"
+if ($sysSig.Status -ne 'Valid') {
+    throw "${module}.sys signature invalid: $($sysSig.Status)"
+}
 
-Write-Output "Signature status: $($sig.Status)"
-Write-Output "Signer: $($sig.SignerCertificate.Subject)"
+if (-not (Test-Path $signtoolPath)) {
+    Write-Output "WARN: signtool not available at '$signtoolPath', skipping catalog cross-check"
+    Write-Output "PASS: ${module} driver is digitally signed (catalog cross-check skipped)"
+    exit 0
+}
+
+Write-Output "Using signtool: $signtoolPath"
+
+& $signtoolPath verify /v /pa /c $cat.FullName $sys.FullName
+if ($LASTEXITCODE -ne 0) {
+    throw "${module}.sys failed catalog verification"
+}
+Write-Output "SYS->CAT: PASS"
 
-if ($sig.Status -ne 'Valid') {
-    throw '@driver_module@.sys is NOT signed (status: ' + $sig.Status + ')'
+& $signtoolPath verify /v /pa /c $cat.FullName $inf.FullName
+if ($LASTEXITCODE -ne 0) {
+    throw "${module}.inf failed catalog verification"
 }
+Write-Output "INF->CAT: PASS"
 
-Write-Output 'PASS: Driver is digitally signed'
+Write-Output "PASS: ${module} driver package is digitally signed"