Whisk the dry mix: In a bowl, whisk the flour, cornstarch, baking powder, baking soda, and salt. Set aside.

Cream the butter and sugar: In a large bowl, beat the butter and sugar until light and fluffy, about 2–3 minutes. This traps air and keeps the cookies tender.

Add eggs and flavor: Beat in the egg yolks and egg one at a time, then mix in the vanilla and citrus zest until smooth.

Bring it together: Add the dry ingredients in two additions. Mix on low just until no dry streaks remain. The dough will be soft but not sticky.

Chill: Divide the dough into two disks, wrap, and chill for at least 1 hour (or up to 24). Chilling prevents spreading and makes rolling easier.

Roll and cut: On a lightly floured surface, roll one disk to about 1/4 inch (6 mm) thickness. Cut rounds using a 2-inch (5 cm) cutter. Transfer to a parchment-lined sheet. Gather scraps, chill briefly if soft, and re-roll.

Bake: Preheat the oven to 350°F (175°C). Bake cookies for 8–10 minutes, until set and just barely golden on the bottoms. Do not overbake—they should look pale on top.

Cool completely: Let the cookies rest on the sheet 2 minutes, then transfer to a rack. They’re delicate when warm.

Fill with dulce de leche: Pair similar-sized cookies. Pipe or spoon about 1–2 teaspoons of dulce de leche on the flat side of one cookie. Gently top with its partner and press lightly to spread.

Finish the edges: If using, roll the sticky edges in shredded coconut. Dust tops with powdered sugar if you like.

Rest before serving: For the best texture, let assembled alfajores sit 1–2 hours. This softens the cookies slightly and lets flavors meld.