diff --git a/README.md b/README.md
index 609e7d6..47ba86b 100644
--- a/README.md
+++ b/README.md
@@ -38,3 +38,5 @@ Plugin activation and deactivation always load MyBB's runtime after explicit con
 `db check` opens the configured MyBB MySQLi write connection and reports connectivity and the count of tables matching this site's configured prefix, without printing connection details. `db backup --output=/path/outside/site.sql` streams only those tables to a new file, writes with restrictive permissions, and publishes it atomically without replacing an existing path. Add `--dry-run` to validate and preview the destination without loading database credentials or connecting. Backups inside the public site root are refused.
 
 **Current limits:** Database diagnostics and backups support MyBB's `mysqli` driver only; SQLite, PostgreSQL, and other adapters fail with a clear unsupported-driver error. `db check`, `db backup`, signed package update, transactional self-update of the installed CLI/toolchain, and plugin lifecycle have passed against a disposable MyBB 1.8.41 + MariaDB 11.4 site. Database restore is not implemented. Plugin search/info and install/update can use the catalog; local manifest and ZIP installs are also supported. External third-party callback behavior is not verified because no upstream plugin is included. The current latest-version fixture resolved to 1.8.41, the same as the supported floor; repeat the matrix against the next supported patch after it is released.
+
+The distribution reference map pins production key `catalog-2026`. The signed toolchain alone owns the installed central trust ring; Admin CP reads that ring. A public pin does not authenticate a PHAR download or complete publication. See [release readiness](https://github.com/mybbresources/mybb-tooling-core/blob/main/RELEASING.md) for the fingerprint, rotation process, private candidate verification, and remaining release gates.
diff --git a/config/trusted-keys.json b/config/trusted-keys.json
index 0967ef4..2e05824 100644
--- a/config/trusted-keys.json
+++ b/config/trusted-keys.json
@@ -1 +1,7 @@
-{}
+{
+    "catalog-2026": {
+        "algorithm": "Ed25519",
+        "public_key": "2DeV6SvalkpiH48iDCdC7SYMa+JarZ5hC36EDWqpafQ=",
+        "not_before": 1793444011
+    }
+}
\ No newline at end of file