diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index 708ae24d..884a43f0 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:737a533f0133b54d60ef43d81daf7ddcf9f552269b8fbb01c27b9997b3cd654c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b0c6e482353fa5795b9ba0d0f2965771e033f26e3e2914276742f1f52f12ba9e
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 8cec36e1..1a7e5d87 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:737a533f0133b54d60ef43d81daf7ddcf9f552269b8fbb01c27b9997b3cd654c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b0c6e482353fa5795b9ba0d0f2965771e033f26e3e2914276742f1f52f12ba9e
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index c7a692df..4480d6fd 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:737a533f0133b54d60ef43d81daf7ddcf9f552269b8fbb01c27b9997b3cd654c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b0c6e482353fa5795b9ba0d0f2965771e033f26e3e2914276742f1f52f12ba9e
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index b08cecc4..825a7e3b 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:737a533f0133b54d60ef43d81daf7ddcf9f552269b8fbb01c27b9997b3cd654c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b0c6e482353fa5795b9ba0d0f2965771e033f26e3e2914276742f1f52f12ba9e
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 57ad85aa..ba05c906 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a6fa86f18c7a454e8a34711c710adb150be68b7c6f6a9f74494b96177647f328
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a27d6dbe6f24cdcb4172074b7eec97d2c34122ac10ebd613a8dfdbb35bc64f5b
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index 6306e47e..f8b3720c 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a6fa86f18c7a454e8a34711c710adb150be68b7c6f6a9f74494b96177647f328
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a27d6dbe6f24cdcb4172074b7eec97d2c34122ac10ebd613a8dfdbb35bc64f5b
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index bf20fed7..14852075 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a6fa86f18c7a454e8a34711c710adb150be68b7c6f6a9f74494b96177647f328
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a27d6dbe6f24cdcb4172074b7eec97d2c34122ac10ebd613a8dfdbb35bc64f5b
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 1a8e8627..633125cb 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a6fa86f18c7a454e8a34711c710adb150be68b7c6f6a9f74494b96177647f328
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:a27d6dbe6f24cdcb4172074b7eec97d2c34122ac10ebd613a8dfdbb35bc64f5b
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 5790c5c8..4cc837a5 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:c700e6783762fdbd10325106fb7651a7fd9188cca1400a13fd4c2e280faf34ae
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:7674be83f6cec5d4bf3dd24b11f8064cfc4b058c26f889b4db0b0e8a2fa16016
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 59a5ba23..56edcf2b 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:c700e6783762fdbd10325106fb7651a7fd9188cca1400a13fd4c2e280faf34ae
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:7674be83f6cec5d4bf3dd24b11f8064cfc4b058c26f889b4db0b0e8a2fa16016
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index e7214f42..fd7078de 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:8a4ad2abc3089c1d5d18a368fceb9322126756bcfd85436ccaf13bae7f35ac7a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:dde9e49a7f2e2afe049bfd8f9d4da7c0ff85b556f227124f760c076830106c6b
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 141d6c36..32b84edb 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:8a4ad2abc3089c1d5d18a368fceb9322126756bcfd85436ccaf13bae7f35ac7a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:dde9e49a7f2e2afe049bfd8f9d4da7c0ff85b556f227124f760c076830106c6b
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 4f4f487c..71f2dd2f 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:84623d124e78f0c4d3c371d2916737074817d495178ecafccbf3fbddcfef58b7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:09270d6482ce5252313c8134266a6689477d6d3b13e8530485e3cf61bc35908a
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 51b07110..7304781e 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:84623d124e78f0c4d3c371d2916737074817d495178ecafccbf3fbddcfef58b7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:09270d6482ce5252313c8134266a6689477d6d3b13e8530485e3cf61bc35908a
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 5591f00f..a713ebb4 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:58aa73258f7fc51c443ab7eb7457890fa997d913a767af77377b76e2ff7d40b1
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:079f541ae6d00ae98d5933940c6ffa67988247d18d837ea6a4e436e7514df1a9
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index 1f53d2d6..6ef2f4a1 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:58aa73258f7fc51c443ab7eb7457890fa997d913a767af77377b76e2ff7d40b1
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:079f541ae6d00ae98d5933940c6ffa67988247d18d837ea6a4e436e7514df1a9
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 6529cbca..ae4115b1 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:add3c62e45a9787d11fe6fb6a144a67a79f9c4513aaeec50a60f337f4b705b1d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:d816b5255a5c296b75ef580e9d794acffb1b257399c9eb51bd34a659a1b2528a
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index a4781225..bd830e49 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:add3c62e45a9787d11fe6fb6a144a67a79f9c4513aaeec50a60f337f4b705b1d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:d816b5255a5c296b75ef580e9d794acffb1b257399c9eb51bd34a659a1b2528a
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 3602a794..cd72dc71 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:737a533f0133b54d60ef43d81daf7ddcf9f552269b8fbb01c27b9997b3cd654c'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b0c6e482353fa5795b9ba0d0f2965771e033f26e3e2914276742f1f52f12ba9e'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"