diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index e08a0577..ead6dc22 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:c318bb1563876e7135a261243feb6564f4cb55a4aa5aa874d52a0670581eb153
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 7f061cdb..e989381c 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:c318bb1563876e7135a261243feb6564f4cb55a4aa5aa874d52a0670581eb153
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 40e14635..833cfafb 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:c318bb1563876e7135a261243feb6564f4cb55a4aa5aa874d52a0670581eb153
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index ea83fcfb..d89d63a2 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:c318bb1563876e7135a261243feb6564f4cb55a4aa5aa874d52a0670581eb153
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 61f834df..237f19ec 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:625ab2152f682000d6929440ea23492cfbed99b1b6ce0e2bced895b3fdc982cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index dd14c0b7..abf93972 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:625ab2152f682000d6929440ea23492cfbed99b1b6ce0e2bced895b3fdc982cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 428e3c70..ee6f3906 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:625ab2152f682000d6929440ea23492cfbed99b1b6ce0e2bced895b3fdc982cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 26a49703..ac137eb7 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:625ab2152f682000d6929440ea23492cfbed99b1b6ce0e2bced895b3fdc982cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 20674a9b..759c7188 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:68156e63e5b69bce67555e154ca6f8a6e236b975ee4436be9b1606a3f51d3f5e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:eee9a89c44f863f9dc6f6eb4bb42910012fd1d2c05b7c9e579e34c136d753bc4
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index c46e63a4..24c1ad6f 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:68156e63e5b69bce67555e154ca6f8a6e236b975ee4436be9b1606a3f51d3f5e
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:eee9a89c44f863f9dc6f6eb4bb42910012fd1d2c05b7c9e579e34c136d753bc4
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index b78042c8..323a1fa0 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:8e722429f359be9effd5aa284d2118076cc69ef950dd954de409e78592acd355
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b11e48bccd835b105ff0dc6abb1acf968b7a87a733395bb0e60daf1b0c47cc0f
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index a498422f..395e50f8 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:8e722429f359be9effd5aa284d2118076cc69ef950dd954de409e78592acd355
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b11e48bccd835b105ff0dc6abb1acf968b7a87a733395bb0e60daf1b0c47cc0f
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 9e4ae9b1..ecec0a61 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:461a8ebbece84e861055c8cb741017b961b76ebeabad60af442684edf74fe83a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0cd432990416d801c81dec13febcc83a90e85ed7f5fe80147343fb56f3d880ee
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 52b1af57..a75321a2 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:461a8ebbece84e861055c8cb741017b961b76ebeabad60af442684edf74fe83a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0cd432990416d801c81dec13febcc83a90e85ed7f5fe80147343fb56f3d880ee
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 01e69a9b..4a751146 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:0c49cbbd76c5ea64ee11a18bd9ec3057abd42766fc9b3c796e44b9e42dcc2f41
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:1c04da1c8946a9dee9e0fed1535d4a50790cb25b7faa9bdeae3094f768ae3b05
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index d68bef2c..9ff7ad62 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:0c49cbbd76c5ea64ee11a18bd9ec3057abd42766fc9b3c796e44b9e42dcc2f41
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:1c04da1c8946a9dee9e0fed1535d4a50790cb25b7faa9bdeae3094f768ae3b05
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 3a59081e..aff901d1 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:bf6fd0cf2ef7eb0a0eb8674f0fc95922431b91ca410d93aa35c2322040d4a435
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:d68d32735ee85b2a4e40e3850d7cc8341799214f0aa19aba0a3e0c349876e9bc
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 4da82f81..750d159b 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:bf6fd0cf2ef7eb0a0eb8674f0fc95922431b91ca410d93aa35c2322040d4a435
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:d68d32735ee85b2a4e40e3850d7cc8341799214f0aa19aba0a3e0c349876e9bc
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 1497e5bc..f5ca7147 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:c318bb1563876e7135a261243feb6564f4cb55a4aa5aa874d52a0670581eb153'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"