diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index 96be3888..ccc1a078 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 1951feea..054dc21f 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index dc76f802..21a4b576 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index 6051468d..19c211db 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index d9e0edee..7ea7d24f 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index a9102e78..c084845a 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 1b9cc5d2..4fffe7ee 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 6d62ecb8..6c758164 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c0bab01176755078fab4cee05c83c5408a99b2b769a09a41e0aee478fda6f707
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index d0fbbf19..273e863d 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:eee9a89c44f863f9dc6f6eb4bb42910012fd1d2c05b7c9e579e34c136d753bc4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:b90de637f2e914487ede65e563b841dc61d92ddbccd5444edfba2d88b5f6c765
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 9d1459fc..4545f3d5 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:eee9a89c44f863f9dc6f6eb4bb42910012fd1d2c05b7c9e579e34c136d753bc4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:b90de637f2e914487ede65e563b841dc61d92ddbccd5444edfba2d88b5f6c765
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index a87b0639..2a7f61d0 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b11e48bccd835b105ff0dc6abb1acf968b7a87a733395bb0e60daf1b0c47cc0f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:ac18c6ead8c16b332a1755b67cc185b12cd5cad9cccc35026b05c54ce48a9fcc
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index f716e2bd..01f5c9e1 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:b11e48bccd835b105ff0dc6abb1acf968b7a87a733395bb0e60daf1b0c47cc0f
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:ac18c6ead8c16b332a1755b67cc185b12cd5cad9cccc35026b05c54ce48a9fcc
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 67bbf712..639cadbe 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0cd432990416d801c81dec13febcc83a90e85ed7f5fe80147343fb56f3d880ee
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:90ec4ebf1992086f3d20d1f9d48c33f273a00f9d31b346b4345cb242ccf107fb
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 03dada85..29baa518 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:0cd432990416d801c81dec13febcc83a90e85ed7f5fe80147343fb56f3d880ee
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:90ec4ebf1992086f3d20d1f9d48c33f273a00f9d31b346b4345cb242ccf107fb
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index f5ca7147..e9b36476 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:732edcb224a18883adb9adfe843ec3057cd3d9cc9728203b5b0a22bda459f89a'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"