diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index a5c94bfd..0ae52af2 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 7e5181fe..901f9f02 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 1fe9bfb0..81a92a5f 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index 3bb09b6a..d6b94506 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 7a275cf3..6da3e0fa 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index 4c4080be..abefc620 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 59306562..5b9f3054 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index e84a8b4d..d90195ab 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:f59ff3b811c288e10ca1e3148a054008c3bba49d841d2805485a4ef39bed1aa4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index b52f6c47..8589e57c 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:03ca87cefe7765843d0feaf8b7760147be5614e713357531b6a3c04dd1f026b4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:008ad6f26d0c78c4976765bee94893fe65710bf28cd94bbbb06ae545a4654051
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 6ed2d5e2..8bcceac5 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:03ca87cefe7765843d0feaf8b7760147be5614e713357531b6a3c04dd1f026b4
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:008ad6f26d0c78c4976765bee94893fe65710bf28cd94bbbb06ae545a4654051
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index d7d9c962..c28ee5ea 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:629a60e894b15d900a6ce657d0f500325de3ea5e3bedce05b029b7826305c8f6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:7efa8bd8d66d2951cfc46188c3ea5c22d356640666d4998ef2544124ed386904
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index f5966cd0..cbba17b9 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:629a60e894b15d900a6ce657d0f500325de3ea5e3bedce05b029b7826305c8f6
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:7efa8bd8d66d2951cfc46188c3ea5c22d356640666d4998ef2544124ed386904
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 7080d9ba..7e59fbd0 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:928f49cb1dd991dc4748a9941103c5ff7da2df0634104622c98940299ee134a1
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:15d0ffa24015b165538824129abf40ad516e4e3e104d933bd812a96550c98052
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 5780b2cb..ab6f6b91 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:928f49cb1dd991dc4748a9941103c5ff7da2df0634104622c98940299ee134a1
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:15d0ffa24015b165538824129abf40ad516e4e3e104d933bd812a96550c98052
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index b7153d41..d76cbee1 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:723584a60e3274940829cfc5627170b317a100d9541108369f9ccfe9fdc97661
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:43dd0c9d7337d483aadac9e1263118c179d56b702713b867d74bfe94159c543b
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index a40f0873..dafd6873 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:723584a60e3274940829cfc5627170b317a100d9541108369f9ccfe9fdc97661
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:43dd0c9d7337d483aadac9e1263118c179d56b702713b867d74bfe94159c543b
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index f5720103..b5437a2e 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:c9c0af4d6b45bff53d2056072f24d5f9aae7c310069dcd102825d063826ff180
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:006406279f5c651687c7a241fa5ff1d2667327045df67d99c4d5cd4605e8595d
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 881302f5..53da4a16 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:c9c0af4d6b45bff53d2056072f24d5f9aae7c310069dcd102825d063826ff180
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:006406279f5c651687c7a241fa5ff1d2667327045df67d99c4d5cd4605e8595d
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 8a7aafaf..68cfa5db 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:b11985140b8de72d474606597c7654c8dc322fffdecaee835cbe89d80e8ec862'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"