diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index b40afc69..73a51d2e 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:8dd307f37831cded8f6a8ec4e118d950e07953bf31d6285d82980e17268e4a28
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:cf6ab53960fecf811e282ac9971234e92c9e496f4bffde342b5840123fd6b88a
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index e0d832c0..30ca9ed2 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:8dd307f37831cded8f6a8ec4e118d950e07953bf31d6285d82980e17268e4a28
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:cf6ab53960fecf811e282ac9971234e92c9e496f4bffde342b5840123fd6b88a
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 179aea8a..b8151903 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:8dd307f37831cded8f6a8ec4e118d950e07953bf31d6285d82980e17268e4a28
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:cf6ab53960fecf811e282ac9971234e92c9e496f4bffde342b5840123fd6b88a
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index ab24eb6c..76e50904 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:8dd307f37831cded8f6a8ec4e118d950e07953bf31d6285d82980e17268e4a28
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:cf6ab53960fecf811e282ac9971234e92c9e496f4bffde342b5840123fd6b88a
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 9c4383d7..53d96df4 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:81e9ca009f3a9fe72a2bb5e4411cef98dbebe3a5aa0f24fbb318427a172316cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:10c60ccfefeb7684e1cc0df9577da3a829973c41ebb263081200ee9d67c71180
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index bd11f3a9..59f5d46b 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:81e9ca009f3a9fe72a2bb5e4411cef98dbebe3a5aa0f24fbb318427a172316cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:10c60ccfefeb7684e1cc0df9577da3a829973c41ebb263081200ee9d67c71180
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index e82338e0..1a7486e3 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:81e9ca009f3a9fe72a2bb5e4411cef98dbebe3a5aa0f24fbb318427a172316cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:10c60ccfefeb7684e1cc0df9577da3a829973c41ebb263081200ee9d67c71180
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index c9f4e1e6..3179ad5a 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:81e9ca009f3a9fe72a2bb5e4411cef98dbebe3a5aa0f24fbb318427a172316cb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:10c60ccfefeb7684e1cc0df9577da3a829973c41ebb263081200ee9d67c71180
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 3c40d816..f933c142 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:1d645dd0c14e5b805b1302fc686b809a89f20fc4298e5b2406cd408e7f93df7c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:af2f0b8f5e9fd37cadae154dab31d9029de33abcb74fc1bdddb8d9af78a749fb
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 1a4f1aa6..62960c09 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:1d645dd0c14e5b805b1302fc686b809a89f20fc4298e5b2406cd408e7f93df7c
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:af2f0b8f5e9fd37cadae154dab31d9029de33abcb74fc1bdddb8d9af78a749fb
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 3c480cd7..1f1469e1 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:3ede0a6cc899a0f1246ae9df58f44c01018012f8897f1e43061cf43df2aa11e2
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:bf7deb7c4b5780072f16d00f8c20f620fe0213be9dbe78f039910f501fb42196
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 34729763..a8f666e9 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:3ede0a6cc899a0f1246ae9df58f44c01018012f8897f1e43061cf43df2aa11e2
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:bf7deb7c4b5780072f16d00f8c20f620fe0213be9dbe78f039910f501fb42196
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 37d9174a..932b0a05 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:55fd0e0cf3513a5bb25c74b031ceae830de12e55dcd595556b13bddc5ecc6fd9
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0357f94524cbbce0f35a1d4ef3f4cf8766669055458103ec45f20a59fbfa4be7
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 4511b35c..3a6a3946 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:55fd0e0cf3513a5bb25c74b031ceae830de12e55dcd595556b13bddc5ecc6fd9
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0357f94524cbbce0f35a1d4ef3f4cf8766669055458103ec45f20a59fbfa4be7
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 5b4de562..3955a6c7 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:13c0d71fb2c0b422eefa926fcbdce591ccfad9aefbe6b17a857f82e0160beb15
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:5fac02ed54c8de97527929e2626ba9b46aeca05113727943c916438752c1f969
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index f52d08cf..abe601d2 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc21
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:13c0d71fb2c0b422eefa926fcbdce591ccfad9aefbe6b17a857f82e0160beb15
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:5fac02ed54c8de97527929e2626ba9b46aeca05113727943c916438752c1f969
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 461dec80..2588d056 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:6ab2676d72ae24cbd102f07563f2bcd4e7a833619b031cd9d809c245991b2c1f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:5bbbb85103e4fc74bc828d1a0807b179736ac4acca76f6bc7c24d0acd85e12fe
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index bdd5e30d..ac36c0cc 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:6ab2676d72ae24cbd102f07563f2bcd4e7a833619b031cd9d809c245991b2c1f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:5bbbb85103e4fc74bc828d1a0807b179736ac4acca76f6bc7c24d0acd85e12fe
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 204f0446..66b97f65 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:8dd307f37831cded8f6a8ec4e118d950e07953bf31d6285d82980e17268e4a28'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:cf6ab53960fecf811e282ac9971234e92c9e496f4bffde342b5840123fd6b88a'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"