diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index a54d5247..02696c14 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:73cf4c0c79ebeb398364bdf93434e42976c105d5426854282bf0b46bce29591e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:9689e087085c394222c943cb81a28810b4b9061d7beecb0d1076f05f663063ce
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 71c6b15d..5f9941ab 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:73cf4c0c79ebeb398364bdf93434e42976c105d5426854282bf0b46bce29591e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:9689e087085c394222c943cb81a28810b4b9061d7beecb0d1076f05f663063ce
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 3cfa1583..3926dcf2 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:73cf4c0c79ebeb398364bdf93434e42976c105d5426854282bf0b46bce29591e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:9689e087085c394222c943cb81a28810b4b9061d7beecb0d1076f05f663063ce
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index d1225e76..e002028e 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:73cf4c0c79ebeb398364bdf93434e42976c105d5426854282bf0b46bce29591e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:9689e087085c394222c943cb81a28810b4b9061d7beecb0d1076f05f663063ce
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index d99d3e7f..00bbb99e 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1a65d76f9b325cf61c5bf7d7c95383bfa9f3f4c03484c233f36aa663e644fe7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:2e94c4967ca0f89ceab13822dda8163b80ff15dd71844ea18fba4430b33ad43b
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index 3e8e10dc..b14d5358 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1a65d76f9b325cf61c5bf7d7c95383bfa9f3f4c03484c233f36aa663e644fe7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:2e94c4967ca0f89ceab13822dda8163b80ff15dd71844ea18fba4430b33ad43b
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 56638bf1..b7d8d917 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1a65d76f9b325cf61c5bf7d7c95383bfa9f3f4c03484c233f36aa663e644fe7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:2e94c4967ca0f89ceab13822dda8163b80ff15dd71844ea18fba4430b33ad43b
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 28f33f71..58ea7d59 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1a65d76f9b325cf61c5bf7d7c95383bfa9f3f4c03484c233f36aa663e644fe7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:2e94c4967ca0f89ceab13822dda8163b80ff15dd71844ea18fba4430b33ad43b
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index c05b38ae..b2201e16 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:e8accea2aa65690d065bd19c90e2aebd362e4655fa47d45b8bc60ba25275c883
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:73ab98f44fa638f1b77170786a6217d661a1c3c0b80cb1417a37e24cf7b6cdfb
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 29a37242..773a52ba 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:e8accea2aa65690d065bd19c90e2aebd362e4655fa47d45b8bc60ba25275c883
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:73ab98f44fa638f1b77170786a6217d661a1c3c0b80cb1417a37e24cf7b6cdfb
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 0e469e62..b9a1a140 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:0e8ea89d3945b6de66b00f7b11b8ebfc977a9076870a6c3d67a29a1246437154
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:a00a96e7fe44cf703333cc3767ec7df429b084f8536cb446c8f7bae25bc614a2
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 18d1cc91..e97c3472 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:0e8ea89d3945b6de66b00f7b11b8ebfc977a9076870a6c3d67a29a1246437154
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:a00a96e7fe44cf703333cc3767ec7df429b084f8536cb446c8f7bae25bc614a2
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 3ef91fbf..8d34be33 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:b80bf15fe1df640a104da7ebceba33b9da758bb36a18ffeb4b1570c69813de91
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:e8db323e8ca5407a0cc3220d0efbed6b1622be9cf4d396e982e462eac7976852
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 1eeaca77..85bf7c75 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:b80bf15fe1df640a104da7ebceba33b9da758bb36a18ffeb4b1570c69813de91
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:e8db323e8ca5407a0cc3220d0efbed6b1622be9cf4d396e982e462eac7976852
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 4a5005bc..1fea9fd0 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:1a57f032c2231e3f3ec75da583a7d203887c3f76b0b77900ac5546d493615dc3
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:07d523dea24b085275a3a6d621d282c5e2ef6680326d049af38a4c54e2f4b498
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index 0715ad2c..4a1414de 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f279
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:1a57f032c2231e3f3ec75da583a7d203887c3f76b0b77900ac5546d493615dc3
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:07d523dea24b085275a3a6d621d282c5e2ef6680326d049af38a4c54e2f4b498
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 38dc6149..73daf017 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:efb27bb2646cb39a2a175b8825663ab97030542c54ed0f0a623f19fc9a975527
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:6a4195273960c68b42cc63d9b21eabed78c509a735d925aae4a5f260c51783fc
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 280b7b79..70693822 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:efb27bb2646cb39a2a175b8825663ab97030542c54ed0f0a623f19fc9a975527
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:6a4195273960c68b42cc63d9b21eabed78c509a735d925aae4a5f260c51783fc
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 6fc5985c..22af0618 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:73cf4c0c79ebeb398364bdf93434e42976c105d5426854282bf0b46bce29591e'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:9689e087085c394222c943cb81a28810b4b9061d7beecb0d1076f05f663063ce'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"