diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index 079b3f29..2b118a39 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bad5f413c0600da30bf7551fd42b183ba88f772c8989c55b71007cd00dbbbfb5
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3fe5966dab8a8d871b787a1fc8e1f4f130953ab3513d8cb5648e09af4ac24b97
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 7187fcf6..138d1117 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bad5f413c0600da30bf7551fd42b183ba88f772c8989c55b71007cd00dbbbfb5
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3fe5966dab8a8d871b787a1fc8e1f4f130953ab3513d8cb5648e09af4ac24b97
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 04633376..fe12ad86 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bad5f413c0600da30bf7551fd42b183ba88f772c8989c55b71007cd00dbbbfb5
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3fe5966dab8a8d871b787a1fc8e1f4f130953ab3513d8cb5648e09af4ac24b97
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index 316f430c..0d9af5a9 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bad5f413c0600da30bf7551fd42b183ba88f772c8989c55b71007cd00dbbbfb5
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3fe5966dab8a8d871b787a1fc8e1f4f130953ab3513d8cb5648e09af4ac24b97
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 789cedc0..f57b190f 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:0727099179c4793b0349c34a476ac04de508c592484381cfecfc841d7c86219d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:da0608f02b837fb11b4d1ebef1d9512194575c5372bec629d98a35ee4cc66e95
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index b68fc8e8..d8ab08ae 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:0727099179c4793b0349c34a476ac04de508c592484381cfecfc841d7c86219d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:da0608f02b837fb11b4d1ebef1d9512194575c5372bec629d98a35ee4cc66e95
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 2a164c88..bffc0436 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:0727099179c4793b0349c34a476ac04de508c592484381cfecfc841d7c86219d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:da0608f02b837fb11b4d1ebef1d9512194575c5372bec629d98a35ee4cc66e95
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index b052d403..00b3d2e7 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:0727099179c4793b0349c34a476ac04de508c592484381cfecfc841d7c86219d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:da0608f02b837fb11b4d1ebef1d9512194575c5372bec629d98a35ee4cc66e95
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 535922bb..327dbb89 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:b02ca09fbc04a9ca4d54c4d85b6032bee91c6a78da0491bc64ac35632a5f41ad
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:024cfe2805df5a9360da4303abd638cfa5f2aeffd6928df024772bf4a8f6fc10
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 8d53276b..a6bc83ef 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:b02ca09fbc04a9ca4d54c4d85b6032bee91c6a78da0491bc64ac35632a5f41ad
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:024cfe2805df5a9360da4303abd638cfa5f2aeffd6928df024772bf4a8f6fc10
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 4820b18c..171cd83a 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b784af003996b2c70d0115455ae7841c051c7c5ba1793dab67f48f5ce8363edf
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b129ed4a35b83f4eb65d7ba7236bae93bdc6b6e474b4699207f75cdd3af76347
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 1fc8d8ce..12c0b72b 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b784af003996b2c70d0115455ae7841c051c7c5ba1793dab67f48f5ce8363edf
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b129ed4a35b83f4eb65d7ba7236bae93bdc6b6e474b4699207f75cdd3af76347
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 81a29a7f..82dfc046 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:c32a277e7296720e329ea5c714651275ce70c484a33a09691d5ed185bfd594b6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0b53faea5c378d64d9effdb76b2ccec0d630e12837aa2001cef16936a88108aa
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index f2560c49..c2d4d799 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:c32a277e7296720e329ea5c714651275ce70c484a33a09691d5ed185bfd594b6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0b53faea5c378d64d9effdb76b2ccec0d630e12837aa2001cef16936a88108aa
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 94049a54..4494429e 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:66b207e737ed151e4e6cca8b9fc17e1f59da2808ec34e4cf6b64c6f51abac607
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:bd1728e793d978b2783a0ebfa2c12e1ad9638e57791154f8657a5d2b2ca69a55
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index 7dbb8f9c..c49fd232 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:52dfbd5afb23a220d5ee92daf
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:66b207e737ed151e4e6cca8b9fc17e1f59da2808ec34e4cf6b64c6f51abac607
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:bd1728e793d978b2783a0ebfa2c12e1ad9638e57791154f8657a5d2b2ca69a55
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 782824b1..82956eb9 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:26669be3366e7c1962d26e40776741b1b918faff9b5d70e56b3f861f0dd5d58f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:a31f3b1fbf2ea01999075ae1691c890a2291499594dc124a00883e728e5536f7
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 1cc938e7..7f2067af 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:26669be3366e7c1962d26e40776741b1b918faff9b5d70e56b3f861f0dd5d58f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:a31f3b1fbf2ea01999075ae1691c890a2291499594dc124a00883e728e5536f7
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 7723e3d6..807558c9 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bad5f413c0600da30bf7551fd42b183ba88f772c8989c55b71007cd00dbbbfb5'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:3fe5966dab8a8d871b787a1fc8e1f4f130953ab3513d8cb5648e09af4ac24b97'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"