diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5e0eea70..33cd8269 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
             require: jq curl python3
           - leg: bash-gawk
             # tag: base
-            image: docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+            image: docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
             require: jq curl
           - leg: busybox
             # tag: 3.24
diff --git a/scripts/bench-consumer b/scripts/bench-consumer
index 1a7dc5ad..13c6e653 100755
--- a/scripts/bench-consumer
+++ b/scripts/bench-consumer
@@ -57,7 +57,7 @@ trap 'printf "bench-consumer: line %s: \"%s\" ended %s\n" "$LINENO" "$BASH_COMMA
 export LC_ALL=C
 
 # tag: base
-ARCH_IMAGE=docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+ARCH_IMAGE=docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 ARCH="${BENCH_ARCH:-x86_64}"
diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index ead6dc22..96be3888 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index e989381c..1951feea 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 833cfafb..dc76f802 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index d89d63a2..6051468d 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -27,7 +27,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 237f19ec..d9e0edee 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index abf93972..a9102e78 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index ee6f3906..1b9cc5d2 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index ac137eb7..6d62ecb8 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 759c7188..d0fbbf19 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -22,7 +22,7 @@ server = https://mirror.iscas.ac.cn/loongarch/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the loong64 image of
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 24c1ad6f..9d1459fc 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -28,7 +28,7 @@ server = https://mirror.iscas.ac.cn/loongarch/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the loong64 image of
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 323a1fa0..a87b0639 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -14,7 +14,7 @@ db_server = https://repo.archlinuxpower.org/base/any
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # tag: ppc
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 395e50f8..f716e2bd 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -13,7 +13,7 @@ db_server = https://repo.archlinuxpower.org/$repo/$arch
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # tag: ppc
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index ecec0a61..67bbf712 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -14,7 +14,7 @@ db_server = https://repo.archlinuxpower.org/base/any
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # tag: ppc64
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index a75321a2..03dada85 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -13,7 +13,7 @@ db_server = https://repo.archlinuxpower.org/$repo/$arch
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # tag: ppc64
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 4a751146..f0b1a886 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -14,7 +14,7 @@ db_server = https://repo.archlinuxpower.org/base/any
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # tag: ppc64le
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index 9ff7ad62..ee2cdb83 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -13,7 +13,7 @@ db_server = https://repo.archlinuxpower.org/$repo/$arch
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # tag: ppc64le
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index aff901d1..7733d76c 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -27,7 +27,7 @@ server = https://mirrors.sustech.edu.cn/archriscv/repo/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the riscv64 image of
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 750d159b..682f7fcf 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -32,7 +32,7 @@ server = https://mirrors.sustech.edu.cn/archriscv/repo/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the riscv64 image of
diff --git a/targets/x86_64-core.conf b/targets/x86_64-core.conf
index 00f1a2ee..00a0d3bd 100644
--- a/targets/x86_64-core.conf
+++ b/targets/x86_64-core.conf
@@ -22,7 +22,7 @@ server = https://mirrors.rit.edu/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root is the verify image's own keyring. The keyring package is
diff --git a/targets/x86_64-extra.conf b/targets/x86_64-extra.conf
index 82517d1f..15608e97 100644
--- a/targets/x86_64-extra.conf
+++ b/targets/x86_64-extra.conf
@@ -22,7 +22,7 @@ server = https://mirrors.rit.edu/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root is the verify image's own keyring. The keyring package is in
diff --git a/targets/x86_64-multilib.conf b/targets/x86_64-multilib.conf
index 7edbce73..b9d85fae 100644
--- a/targets/x86_64-multilib.conf
+++ b/targets/x86_64-multilib.conf
@@ -22,7 +22,7 @@ server = https://mirrors.rit.edu/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 verify_platform = linux/amd64
 
 # The trust root is the verify image's own keyring. The keyring package is in
diff --git a/tests/integration/10-pipeline.sh b/tests/integration/10-pipeline.sh
index f17b3c59..61220390 100644
--- a/tests/integration/10-pipeline.sh
+++ b/tests/integration/10-pipeline.sh
@@ -33,7 +33,7 @@ set -euo pipefail
 . "$REPO_ROOT/tests/lib/harness.sh"
 
 # tag: base
-ARCH_IMAGE=docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+ARCH_IMAGE=docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 # tag: 3
 REGISTRY_IMAGE=docker.io/library/registry:3@sha256:d4032d4cc323c1731c707931ecada07a53076eac38e3b61ae57533f170f2c6c3
 # tag: 1.38
diff --git a/tests/integration/20-client.sh b/tests/integration/20-client.sh
index d598ab8b..7240aaa9 100644
--- a/tests/integration/20-client.sh
+++ b/tests/integration/20-client.sh
@@ -22,7 +22,7 @@ set -euo pipefail
 . "$REPO_ROOT/tests/lib/harness.sh"
 
 # tag: base
-ARCH_IMAGE=docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92dafcb4c788d96c026ed04179890c23adef4c897fa0
+ARCH_IMAGE=docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b058df6eaab18b737c27473a7234a40fdecb9413
 # tag: 3
 REGISTRY_IMAGE=docker.io/library/registry:3@sha256:d4032d4cc323c1731c707931ecada07a53076eac38e3b61ae57533f170f2c6c3
 # tag: 3.15-alpine