diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index ccc1a078..a5c94bfd 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 054dc21f..7e5181fe 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 21a4b576..1fe9bfb0 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index 19c211db..3bb09b6a 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 7ea7d24f..7a275cf3 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index c084845a..4c4080be 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 4fffe7ee..59306562 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 6c758164..e84a8b4d 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f1e4c26eeef18e89a376259220f3d195790786a5adf4aaef079ec17334d7f7a7
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 273e863d..b52f6c47 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:b90de637f2e914487ede65e563b841dc61d92ddbccd5444edfba2d88b5f6c765
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:03ca87cefe7765843d0feaf8b7760147be5614e713357531b6a3c04dd1f026b4
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 4545f3d5..6ed2d5e2 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:b90de637f2e914487ede65e563b841dc61d92ddbccd5444edfba2d88b5f6c765
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:03ca87cefe7765843d0feaf8b7760147be5614e713357531b6a3c04dd1f026b4
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 2a7f61d0..d7d9c962 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:ac18c6ead8c16b332a1755b67cc185b12cd5cad9cccc35026b05c54ce48a9fcc
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:629a60e894b15d900a6ce657d0f500325de3ea5e3bedce05b029b7826305c8f6
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 01f5c9e1..f5966cd0 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:ac18c6ead8c16b332a1755b67cc185b12cd5cad9cccc35026b05c54ce48a9fcc
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:629a60e894b15d900a6ce657d0f500325de3ea5e3bedce05b029b7826305c8f6
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 639cadbe..7080d9ba 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:90ec4ebf1992086f3d20d1f9d48c33f273a00f9d31b346b4345cb242ccf107fb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:928f49cb1dd991dc4748a9941103c5ff7da2df0634104622c98940299ee134a1
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 29baa518..5780b2cb 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:90ec4ebf1992086f3d20d1f9d48c33f273a00f9d31b346b4345cb242ccf107fb
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:928f49cb1dd991dc4748a9941103c5ff7da2df0634104622c98940299ee134a1
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index c7cfcf63..b7153d41 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:c71ef447d640eafeee59fc124a100f69b8ac4d36ad6eed3a242c8ff890fd73b3
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:723584a60e3274940829cfc5627170b317a100d9541108369f9ccfe9fdc97661
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index b2915180..a40f0873 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:c71ef447d640eafeee59fc124a100f69b8ac4d36ad6eed3a242c8ff890fd73b3
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:723584a60e3274940829cfc5627170b317a100d9541108369f9ccfe9fdc97661
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index bef28358..f5720103 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:d8122cc6b2d936edaf9086430701d93c81992f647297ef4c3a3b954dbf2d8270
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:c9c0af4d6b45bff53d2056072f24d5f9aae7c310069dcd102825d063826ff180
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 98976b5b..881302f5 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:d8122cc6b2d936edaf9086430701d93c81992f647297ef4c3a3b954dbf2d8270
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:c9c0af4d6b45bff53d2056072f24d5f9aae7c310069dcd102825d063826ff180
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index e9b36476..8a7aafaf 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:bfbd221276962abb832f6b476b38ba5215d7f9ea10ea7160e5e2a46c559168f4'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"