diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh
index 8b61f39..7c0018c 100755
--- a/scripts/image_signing/sign_official_build.sh
+++ b/scripts/image_signing/sign_official_build.sh
@@ -301,12 +301,17 @@
   local expected_hash=$(get_hash_from_config "${new_kernel_config}")
   local got_hash=$(get_hash_from_config "${kernel_config}")
 
+  if [ -z "${expected_hash}" ]; then
+    echo "FAILED: RootFS hash is empty!"
+    exit 1
+  fi
   if [ ! "${got_hash}" = "${expected_hash}" ]; then
     cat <<EOF
 FAILED: RootFS hash is incorrect.
 Expected: ${expected_hash}
 Got: ${got_hash}
 EOF
+    exit 1
   else
     echo "PASS: RootFS hash is correct (${expected_hash})"
   fi