diff --git a/src/cmd/internal/codesign/codesign.go b/src/cmd/internal/codesign/codesign.go
index 24496e2000..33671ce835 100644
--- a/src/cmd/internal/codesign/codesign.go
+++ b/src/cmd/internal/codesign/codesign.go
@@ -11,6 +11,7 @@
 package codesign
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"debug/macho"
 	"encoding/binary"
@@ -247,21 +248,35 @@ func Sign(out []byte, data io.Reader, id string, codeSize, textOff, textSize int
 	outp = puts(outp, []byte(id+"\000"))
 
 	// emit hashes
+	datab, isBytes := data.(*bytes.Buffer)
 	var buf [pageSize]byte
 	p := 0
 	for p < int(codeSize) {
-		n, err := io.ReadFull(data, buf[:])
-		if err == io.EOF {
-			break
-		}
-		if err != nil && err != io.ErrUnexpectedEOF {
-			panic(err)
+		var chunk []byte
+		if isBytes {
+			// If it is already a byte slice, we can read without copying
+			chunk = datab.Next(pageSize)
+			if len(chunk) == 0 {
+				break
+			}
+		} else {
+			n, err := io.ReadFull(data, buf[:])
+			if err == io.EOF {
+				break
+			}
+			if err != nil && err != io.ErrUnexpectedEOF {
+				panic(err)
+			}
+			chunk = buf[:n]
 		}
+
+		n := len(chunk)
 		if p+n > int(codeSize) {
 			n = int(codeSize) - p
+			chunk = chunk[:n]
 		}
 		p += n
-		b := sha256.Sum256(buf[:n])
+		b := sha256.Sum256(chunk)
 		outp = puts(outp, b[:])
 	}
 }
diff --git a/src/cmd/link/internal/ld/macho.go b/src/cmd/link/internal/ld/macho.go
index 45fdcdeb17..fd351bacc0 100644
--- a/src/cmd/link/internal/ld/macho.go
+++ b/src/cmd/link/internal/ld/macho.go
@@ -880,7 +880,7 @@ func asmbMacho(ctxt *Link) {
 		if int64(len(data)) != codesigOff {
 			panic("wrong size")
 		}
-		codesign.Sign(ldr.Data(cs), bytes.NewReader(data), "a.out", codesigOff, int64(mstext.fileoffset), int64(mstext.filesize), ctxt.IsExe() || ctxt.IsPIE())
+		codesign.Sign(ldr.Data(cs), bytes.NewBuffer(data), "a.out", codesigOff, int64(mstext.fileoffset), int64(mstext.filesize), ctxt.IsExe() || ctxt.IsPIE())
 		ctxt.Out.SeekSet(codesigOff)
 		ctxt.Out.Write(ldr.Data(cs))
 	}