diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index b587ff7f..999e714c 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3635edfb1224cf14e08249060e216735b766373037cca0265d0da47dffeead0c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:dd89780d86c0941d612b5aa6203c5e6c446db7b6d98130b7556c98c5c6dcff06
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index c07998ae..93532876 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3635edfb1224cf14e08249060e216735b766373037cca0265d0da47dffeead0c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:dd89780d86c0941d612b5aa6203c5e6c446db7b6d98130b7556c98c5c6dcff06
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 89b87b28..a701e618 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3635edfb1224cf14e08249060e216735b766373037cca0265d0da47dffeead0c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:dd89780d86c0941d612b5aa6203c5e6c446db7b6d98130b7556c98c5c6dcff06
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index e8714c40..7d94cdb8 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3635edfb1224cf14e08249060e216735b766373037cca0265d0da47dffeead0c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:dd89780d86c0941d612b5aa6203c5e6c446db7b6d98130b7556c98c5c6dcff06
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 01e09d2c..ecc168d2 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:8e9f6fc577a782a665d18ad8e5a62e3e733658b81ea8cf6dfb2ef540c1a92128
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:3dbca93d4aade0f139d1c53a9003d50a11d285bdf7d636c52cf432d17faba527
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index e6793c2d..76cca4b6 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:8e9f6fc577a782a665d18ad8e5a62e3e733658b81ea8cf6dfb2ef540c1a92128
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:3dbca93d4aade0f139d1c53a9003d50a11d285bdf7d636c52cf432d17faba527
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 9e9772c9..3fca69a2 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:8e9f6fc577a782a665d18ad8e5a62e3e733658b81ea8cf6dfb2ef540c1a92128
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:3dbca93d4aade0f139d1c53a9003d50a11d285bdf7d636c52cf432d17faba527
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 21bd44d0..24aced62 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:8e9f6fc577a782a665d18ad8e5a62e3e733658b81ea8cf6dfb2ef540c1a92128
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:3dbca93d4aade0f139d1c53a9003d50a11d285bdf7d636c52cf432d17faba527
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 1fa0a587..2c005b9f 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:094408fa74850052aa31e1e6dbb458ffedf2e3c115910c394b89fc4eb6a4abfa
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:8e67c61a58041611d0ec5c468b543ca6189ce7613f29357a283aa753e8a5678e
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 5002474c..072dea7b 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:094408fa74850052aa31e1e6dbb458ffedf2e3c115910c394b89fc4eb6a4abfa
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:8e67c61a58041611d0ec5c468b543ca6189ce7613f29357a283aa753e8a5678e
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 7c1377d3..10733a48 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:fa7a82012c661c343acd9a8463024878dc1af1e33e8955b6fb6c1a0f8bd7a12f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:2909bce3b506beaefed99cbd022787430a40d4448e654cfefbf60a124d16fc2e
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 1038c7c8..f6f87012 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:fa7a82012c661c343acd9a8463024878dc1af1e33e8955b6fb6c1a0f8bd7a12f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:2909bce3b506beaefed99cbd022787430a40d4448e654cfefbf60a124d16fc2e
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 2f4fd322..37449ea6 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:9eb0aea71512af4e32c30bc59a4060f5632c9796d70e5e4c2173bbdab4876fae
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:602270cfa46816f69d7ce657f447e951450dd96e106878a6e0d132b99fcd6b61
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 43af59f0..d84938e8 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:9eb0aea71512af4e32c30bc59a4060f5632c9796d70e5e4c2173bbdab4876fae
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:602270cfa46816f69d7ce657f447e951450dd96e106878a6e0d132b99fcd6b61
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index c2c51405..bff8d421 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:7720faad68b889604ecdd02502a0a527e83433e7bdf687df5fb49e416dec9186
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:7b0d09627502b79095f9927e2930bdc471c7614777bfb52d4b07f10ec209bdbc
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index 8b6d9e72..b7cafb97 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:7720faad68b889604ecdd02502a0a527e83433e7bdf687df5fb49e416dec9186
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:7b0d09627502b79095f9927e2930bdc471c7614777bfb52d4b07f10ec209bdbc
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 12e42cec..aee5ca34 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:1ada61d6da1e750df3b296e771dc2767d180cb41cd20fc57dfb556510a6d6f73
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:060424a8da0b8381dbf07b0a3e28ffc334b97073d1c9671556e89aad078da2a3
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 71b0838e..8f6851ea 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:1ada61d6da1e750df3b296e771dc2767d180cb41cd20fc57dfb556510a6d6f73
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:060424a8da0b8381dbf07b0a3e28ffc334b97073d1c9671556e89aad078da2a3
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index c5b1e4b4..61ddba76 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3635edfb1224cf14e08249060e216735b766373037cca0265d0da47dffeead0c'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:dd89780d86c0941d612b5aa6203c5e6c446db7b6d98130b7556c98c5c6dcff06'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"