Simple! I should have mentioned the .exe was previously signed. The solution is to do:

signtool remove /s %outputfile%

before the rcedit. Then after that, signtool to sign - works fine.