diff --git a/lib/cherry_pick.js b/lib/cherry_pick.js
index a45405f3..df0503fa 100644
--- a/lib/cherry_pick.js
+++ b/lib/cherry_pick.js
@@ -11,12 +11,16 @@ export default class CherryPick {
   constructor(prid, dir, cli, {
     owner,
     repo,
+    upstream,
+    gpgSign,
     lint,
     includeCVE
   } = {}) {
     this.prid = prid;
     this.cli = cli;
     this.dir = dir;
+    this.upstream = upstream;
+    this.gpgSign = gpgSign;
     this.options = { owner, repo, lint, includeCVE };
   }
 
@@ -88,14 +92,15 @@ export default class CherryPick {
       } else if (cleanLint === LINT_RESULTS.SUCCESS) {
         cli.ok('Lint passed cleanly');
       }
-      return this.amend(metadata.metadata, commitInfo);
+      this.metadata = metadata.metadata;
+      return this.amend(commitInfo);
     } catch (e) {
       cli.error(e.message);
       return false;
     }
   }
 
-  async amend(metadata, commitInfo) {
+  async amend(commitInfo) {
     const { cli } = this;
     const subjects = await runAsync('git',
       ['log', '--pretty=format:%s', `${commitInfo.base}..${commitInfo.head}`],
@@ -116,7 +121,7 @@ export default class CherryPick {
       await runAsync('git', ['commit', '--amend', '--no-edit']);
     }
 
-    return LandingSession.prototype.amend.call(this, metadata);
+    return LandingSession.prototype.amend.call(this);
   }
 
   readyToAmend() {
diff --git a/lib/landing_session.js b/lib/landing_session.js
index 40e60e8f..139eabc3 100644
--- a/lib/landing_session.js
+++ b/lib/landing_session.js
@@ -7,6 +7,7 @@ import Session from './session.js';
 import {
   shortSha, isGhAvailable, getEditor
 } from './utils.js';
+import { debuglog, isDebugVerbosity } from './verbosity.js';
 
 const isWindows = process.platform === 'win32';
 
@@ -27,9 +28,6 @@ export default class LandingSession extends Session {
     this.lint = lint;
     this.autorebase = autorebase;
     this.fixupAll = fixupAll;
-    this.gpgSign = argv?.['gpg-sign']
-      ? (argv['gpg-sign'] === true ? ['-S'] : ['-S', argv['gpg-sign']])
-      : [];
     this.oneCommitMax = oneCommitMax;
     this.expectedCommitShas = [];
     this.checkCI = !!checkCI;
@@ -120,6 +118,9 @@ export default class LandingSession extends Session {
         ['cherry-pick', '--allow-empty', ...this.gpgSign, `${base}..${head}`],
         { ignoreFailure: false });
     } catch (ex) {
+      if (isDebugVerbosity()) {
+        debuglog('[LandingSession] Got error', ex);
+      }
       cli.error('Failed to apply patches');
       process.exit(1);
     }
diff --git a/lib/prepare_release.js b/lib/prepare_release.js
index a90032e9..eea137a8 100644
--- a/lib/prepare_release.js
+++ b/lib/prepare_release.js
@@ -70,6 +70,8 @@ export default class ReleasePreparation extends Session {
       const cp = new CherryPick(pr.number, this.dir, cli, {
         owner: this.owner,
         repo: this.repo,
+        gpgSign: this.gpgSign,
+        upstream: this.isSecurityRelease ? `https://${this.username}:${this.config.token}@github.com/${this.owner}/${this.repo}.git` : this.upstream,
         lint: false,
         includeCVE: true
       });
diff --git a/lib/promote_release.js b/lib/promote_release.js
index 1b9443b5..ca799273 100644
--- a/lib/promote_release.js
+++ b/lib/promote_release.js
@@ -17,13 +17,10 @@ const dryRunMessage = 'You are running in dry-run mode, meaning NCU will not run
 
 export default class ReleasePromotion extends Session {
   constructor(argv, req, cli, dir) {
-    super(cli, dir);
+    super(cli, dir, null, argv);
     this.req = req;
     this.dryRun = !argv.run;
     this.proposalUpstreamRemote = argv.fetchFrom ?? this.upstream;
-    this.gpgSign = argv?.['gpg-sign']
-      ? (argv['gpg-sign'] === true ? ['-S'] : ['-S', argv['gpg-sign']])
-      : [];
   }
 
   get branch() {
diff --git a/lib/session.js b/lib/session.js
index 59025af1..4ce08a93 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -20,6 +20,9 @@ export default class Session {
     this.dir = dir;
     this.prid = prid;
     this.config = { ...getMergedConfig(this.dir), ...argv };
+    this.gpgSign = argv?.['gpg-sign']
+      ? (argv['gpg-sign'] === true ? ['-S'] : ['-S', argv['gpg-sign']])
+      : [];
 
     if (warnForMissing) {
       const { upstream, owner, repo } = this;
diff --git a/lib/voting_session.js b/lib/voting_session.js
index 377aef2e..e6db3601 100644
--- a/lib/voting_session.js
+++ b/lib/voting_session.js
@@ -29,7 +29,6 @@ export default class VotingSession extends Session {
     this.abstain = abstain;
     this.closeVote = argv['decrypt-key-part'];
     this.postComment = argv['post-comment'];
-    this.gpgSign = argv['gpg-sign'];
   }
 
   get argv() {