diff --git a/22/alpine3.23/Dockerfile b/22/alpine3.23/Dockerfile
index 465453c59..e3d1a1999 100644
--- a/22/alpine3.23/Dockerfile
+++ b/22/alpine3.23/Dockerfile
@@ -89,11 +89,14 @@ RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/22/alpine3.24/Dockerfile b/22/alpine3.24/Dockerfile
index 4af3a5eb3..6252d1c45 100644
--- a/22/alpine3.24/Dockerfile
+++ b/22/alpine3.24/Dockerfile
@@ -89,11 +89,14 @@ RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/22/bookworm-slim/Dockerfile b/22/bookworm-slim/Dockerfile
index e31265c0a..57880e061 100644
--- a/22/bookworm-slim/Dockerfile
+++ b/22/bookworm-slim/Dockerfile
@@ -69,11 +69,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/22/bookworm/Dockerfile b/22/bookworm/Dockerfile
index a23ea2c17..3b6be6389 100644
--- a/22/bookworm/Dockerfile
+++ b/22/bookworm/Dockerfile
@@ -53,11 +53,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/22/trixie-slim/Dockerfile b/22/trixie-slim/Dockerfile
index e104e6bd4..33588ff9e 100644
--- a/22/trixie-slim/Dockerfile
+++ b/22/trixie-slim/Dockerfile
@@ -69,11 +69,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/22/trixie/Dockerfile b/22/trixie/Dockerfile
index 93ed8bcb9..69b8672f5 100644
--- a/22/trixie/Dockerfile
+++ b/22/trixie/Dockerfile
@@ -53,11 +53,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/24/alpine3.23/Dockerfile b/24/alpine3.23/Dockerfile
index f50b16026..bbd989935 100644
--- a/24/alpine3.23/Dockerfile
+++ b/24/alpine3.23/Dockerfile
@@ -88,11 +88,14 @@ RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/24/alpine3.24/Dockerfile b/24/alpine3.24/Dockerfile
index a76589978..d8ee25f6d 100644
--- a/24/alpine3.24/Dockerfile
+++ b/24/alpine3.24/Dockerfile
@@ -88,11 +88,14 @@ RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/24/bookworm-slim/Dockerfile b/24/bookworm-slim/Dockerfile
index 152b58538..9e4b1a056 100644
--- a/24/bookworm-slim/Dockerfile
+++ b/24/bookworm-slim/Dockerfile
@@ -68,11 +68,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/24/bookworm/Dockerfile b/24/bookworm/Dockerfile
index 2cc21fce6..630c8bad5 100644
--- a/24/bookworm/Dockerfile
+++ b/24/bookworm/Dockerfile
@@ -52,11 +52,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/24/trixie-slim/Dockerfile b/24/trixie-slim/Dockerfile
index c8f0dde2f..4f30fe705 100644
--- a/24/trixie-slim/Dockerfile
+++ b/24/trixie-slim/Dockerfile
@@ -69,11 +69,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/24/trixie/Dockerfile b/24/trixie/Dockerfile
index 6fcf047e3..c34985572 100644
--- a/24/trixie/Dockerfile
+++ b/24/trixie/Dockerfile
@@ -53,11 +53,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/Dockerfile-alpine.template b/Dockerfile-alpine.template
index c1ae4f377..3d781362c 100644
--- a/Dockerfile-alpine.template
+++ b/Dockerfile-alpine.template
@@ -80,11 +80,14 @@ RUN apk add --no-cache --virtual .build-deps-yarn curl gnupg tar \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/Dockerfile-debian.template b/Dockerfile-debian.template
index 4c5fb79b3..38dd9db70 100644
--- a/Dockerfile-debian.template
+++ b/Dockerfile-debian.template
@@ -42,11 +42,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \
diff --git a/Dockerfile-slim.template b/Dockerfile-slim.template
index ba8872319..3b1f24f6a 100644
--- a/Dockerfile-slim.template
+++ b/Dockerfile-slim.template
@@ -58,11 +58,14 @@ RUN set -ex \
     6A010C5166006599AA17F08146C2130DFD2497F5 \
   ; do \
     { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
-    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
+    { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
+    # fall back to the key published by Yarn if no keyserver is reachable; the signer is pinned by fingerprint below
+    { curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --batch --import; } ; \
   done \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" \
   && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" \
-  && gpg --batch --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+  && gpg --batch --status-fd 1 --verify yarn-v$YARN_VERSION.tar.gz.asc yarn-v$YARN_VERSION.tar.gz \
+    | grep -q "^\[GNUPG:\] VALIDSIG .* 72ECF46A56B4AD39C907BBB71646B01B86E50310\$" \
   && gpgconf --kill all \
   && rm -rf "$GNUPGHOME" \
   && mkdir -p /opt \