diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index 5a3f4554..a4f980ce 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:25d909714baa2d2f8cab850f88dacb73beb5d72f1d5090feab95eef7351527b6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:e662cd178f5a31a31d2618a7fc5343643f801b5a28af20cfa3881bfdd7b44888
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 39333db2..614636a8 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:25d909714baa2d2f8cab850f88dacb73beb5d72f1d5090feab95eef7351527b6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:e662cd178f5a31a31d2618a7fc5343643f801b5a28af20cfa3881bfdd7b44888
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 1be345e5..09f11e27 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:25d909714baa2d2f8cab850f88dacb73beb5d72f1d5090feab95eef7351527b6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:e662cd178f5a31a31d2618a7fc5343643f801b5a28af20cfa3881bfdd7b44888
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index 47fe617b..ae90a928 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:25d909714baa2d2f8cab850f88dacb73beb5d72f1d5090feab95eef7351527b6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:e662cd178f5a31a31d2618a7fc5343643f801b5a28af20cfa3881bfdd7b44888
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 0e20e47a..8e03c71c 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:25cf24909aa5e6e24653843e7a294ff89e4f4e0fc3119a401a1f7d0d6707d22e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a7ed5c978f77c6557d16895266ae3fd8fb4a41088d286091a21d1da15297b9df
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index 48802537..fbb08048 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:25cf24909aa5e6e24653843e7a294ff89e4f4e0fc3119a401a1f7d0d6707d22e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a7ed5c978f77c6557d16895266ae3fd8fb4a41088d286091a21d1da15297b9df
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index c67a71c5..a3e653f6 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:25cf24909aa5e6e24653843e7a294ff89e4f4e0fc3119a401a1f7d0d6707d22e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a7ed5c978f77c6557d16895266ae3fd8fb4a41088d286091a21d1da15297b9df
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 44d11bc3..164f5e9c 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:25cf24909aa5e6e24653843e7a294ff89e4f4e0fc3119a401a1f7d0d6707d22e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a7ed5c978f77c6557d16895266ae3fd8fb4a41088d286091a21d1da15297b9df
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 09a9e60c..b7ec7072 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:2129ca7116da24244dd36954dc7742d8234d2aaa766d202bf374ff19cead6649
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:20e3d44aea16cc768424e40fa77870be4385163da1f41d7092e10e912b8a9930
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index c9e60535..68387f45 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:2129ca7116da24244dd36954dc7742d8234d2aaa766d202bf374ff19cead6649
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:20e3d44aea16cc768424e40fa77870be4385163da1f41d7092e10e912b8a9930
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 4fe42513..bba7bb52 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b281f6ac23aa123668d533afe0cba177f3c6bd9303418372135632df7e1da302
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:e217d5d67773e346a170a9a129d3871a27eaffd2540ae3905d1f07bd433c4308
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index f01570fa..958d35d6 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b281f6ac23aa123668d533afe0cba177f3c6bd9303418372135632df7e1da302
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:e217d5d67773e346a170a9a129d3871a27eaffd2540ae3905d1f07bd433c4308
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 6892af3a..316c68fd 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:b8cba53cbd1e53bce4795f045eb61060410554b0098e56253038c781af31f4e1
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:ecc01bb30fa22f7940432471c79f23c738c0025aabde3f9778f3d50b39cb00e9
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index d4e6896b..79c00659 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:b8cba53cbd1e53bce4795f045eb61060410554b0098e56253038c781af31f4e1
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:ecc01bb30fa22f7940432471c79f23c738c0025aabde3f9778f3d50b39cb00e9
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 2256736c..1b8be54c 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:e84316b1fc612947a39634df605e377b460611919462bf9387c51b0bd9fb710c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:b0ce0dcc3248e64740d6f809ffa7756b9579e1a982dfe8ddae1bd81a89ce5f5f
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index aa0d5179..089c1530 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:e84316b1fc612947a39634df605e377b460611919462bf9387c51b0bd9fb710c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:b0ce0dcc3248e64740d6f809ffa7756b9579e1a982dfe8ddae1bd81a89ce5f5f
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index b1d714d2..a25b7e2b 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:c5c23f55338f735aecd90daff2c5a80b5eeac36f185667e9fecf850578398631
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:9f73d51b87cb190069dcb2c30fbdb8315967c43061f7491d3d7e65524a1eb652
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index ed548f3c..2d1ad71c 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:c5c23f55338f735aecd90daff2c5a80b5eeac36f185667e9fecf850578398631
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:9f73d51b87cb190069dcb2c30fbdb8315967c43061f7491d3d7e65524a1eb652
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index dc95cf87..412f4b97 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:25d909714baa2d2f8cab850f88dacb73beb5d72f1d5090feab95eef7351527b6'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:e662cd178f5a31a31d2618a7fc5343643f801b5a28af20cfa3881bfdd7b44888'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"