diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index 0ae52af2..aa573673 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:05fefe98d4a7cfa0d428698ba4d3ea47d928c2665b66159d53827beb12a1d7b9
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index 901f9f02..cd730d4c 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:05fefe98d4a7cfa0d428698ba4d3ea47d928c2665b66159d53827beb12a1d7b9
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index 81a92a5f..6a4e4739 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:05fefe98d4a7cfa0d428698ba4d3ea47d928c2665b66159d53827beb12a1d7b9
 keyring_platform = linux/arm64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index d6b94506..c933c07a 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -34,7 +34,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: aarch64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381
+keyring_image = ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:05fefe98d4a7cfa0d428698ba4d3ea47d928c2665b66159d53827beb12a1d7b9
 keyring_platform = linux/arm64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 6da3e0fa..c412da8a 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:94389c94364d044c999201fa52eddc4ba357d06390dbb77f443550a656268f73
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index abefc620..f9329c23 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:94389c94364d044c999201fa52eddc4ba357d06390dbb77f443550a656268f73
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 5b9f3054..6d6b2b7a 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:94389c94364d044c999201fa52eddc4ba357d06390dbb77f443550a656268f73
 keyring_platform = linux/arm/v7
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index d90195ab..b43c3416 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # pkgforge-dev/docker-archlinux (archlinuxarm.gpg and its trust), copied out
 # of it and never run. The x86_64 image keeps its own archlinux keyring.
 # tag: armv7h
-keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:c61d9f064d53024af3f76fa87df00a098aa9db88d4a1f5bd9d35c2a8b2cc105a
+keyring_image = ghcr.io/pkgforge-dev/archlinux:armv7h@sha256:94389c94364d044c999201fa52eddc4ba357d06390dbb77f443550a656268f73
 keyring_platform = linux/arm/v7
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 8589e57c..79c0d55d 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -30,7 +30,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:008ad6f26d0c78c4976765bee94893fe65710bf28cd94bbbb06ae545a4654051
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:1e19f53c78452cf59336dd2412bd584c6fb16e894d6ce79d552356df2cff19a4
 keyring_platform = linux/loong64
 
 # Both keyring packages, installed from the snapshot before anything else is
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 8bcceac5..474908ee 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -36,7 +36,7 @@ verify_platform = linux/amd64
 # of it and never run. The x86_64 image keeps its own archlinux keyring, which
 # signs the port's any packages.
 # tag: loong64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:008ad6f26d0c78c4976765bee94893fe65710bf28cd94bbbb06ae545a4654051
+keyring_image = ghcr.io/pkgforge-dev/archlinux:loong64@sha256:1e19f53c78452cf59336dd2412bd584c6fb16e894d6ce79d552356df2cff19a4
 keyring_platform = linux/loong64
 
 # Both keyring packages are in core: verify installs them from the promoted
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index c28ee5ea..1e4caec8 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:7efa8bd8d66d2951cfc46188c3ea5c22d356640666d4998ef2544124ed386904
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:ccdfe30e836bdd7d2b8303d99776dcbeadd4dabb6f70f17418248788a0bb7c22
 keyring_platform = linux/ppc
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index cbba17b9..1ef7e2f8 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:7efa8bd8d66d2951cfc46188c3ea5c22d356640666d4998ef2544124ed386904
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc@sha256:ccdfe30e836bdd7d2b8303d99776dcbeadd4dabb6f70f17418248788a0bb7c22
 keyring_platform = linux/ppc
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 7e59fbd0..7813913f 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:15d0ffa24015b165538824129abf40ad516e4e3e104d933bd812a96550c98052
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:5653bf302608f10be51dca2591ab1075ef459d4d1c9eeb76e0b9cebae15bcc30
 keyring_platform = linux/ppc64
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index ab6f6b91..da4c1835 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:15d0ffa24015b165538824129abf40ad516e4e3e104d933bd812a96550c98052
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64@sha256:5653bf302608f10be51dca2591ab1075ef459d4d1c9eeb76e0b9cebae15bcc30
 keyring_platform = linux/ppc64
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index d76cbee1..0532c241 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -18,7 +18,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:43dd0c9d7337d483aadac9e1263118c179d56b702713b867d74bfe94159c543b
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:f85fc0c75e6cc5e9666996df8048bef5a649426f22654ad9f1e3b3cdd28a7eca
 keyring_platform = linux/ppc64le
 
 # The keyring package is in this repository, so no keyring_from.
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index dafd6873..5606dc72 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -17,7 +17,7 @@ verify_image = docker.io/library/archlinux:base@sha256:e82623936fa1a69700b48e98b
 verify_platform = linux/amd64
 
 # tag: ppc64le
-keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:43dd0c9d7337d483aadac9e1263118c179d56b702713b867d74bfe94159c543b
+keyring_image = ghcr.io/pkgforge-dev/archlinux:ppc64le@sha256:f85fc0c75e6cc5e9666996df8048bef5a649426f22654ad9f1e3b3cdd28a7eca
 keyring_platform = linux/ppc64le
 
 # The keyring package is in base-any. keyring_from names that target of this
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index b5437a2e..3fb99aed 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -35,7 +35,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:006406279f5c651687c7a241fa5ff1d2667327045df67d99c4d5cd4605e8595d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:ea2c0e5d04a3afed1570771c45aa57f5bb016d4f37b7a4e73559a418e402e4ba
 keyring_platform = linux/riscv64
 
 # The keyring package, installed from the snapshot before anything else is
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 53da4a16..27260863 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -40,7 +40,7 @@ verify_platform = linux/amd64
 # signature in the port is by a key in archlinux.gpg (2026-10-14), which the
 # x86_64 image keeps as its own; the image follows the port if that changes.
 # tag: riscv64
-keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:006406279f5c651687c7a241fa5ff1d2667327045df67d99c4d5cd4605e8595d
+keyring_image = ghcr.io/pkgforge-dev/archlinux:riscv64@sha256:ea2c0e5d04a3afed1570771c45aa57f5bb016d4f37b7a4e73559a418e402e4ba
 keyring_platform = linux/riscv64
 
 # The keyring package is in core: verify installs it from the promoted
diff --git a/tests/unit/40-lib.sh b/tests/unit/40-lib.sh
index 68cfa5db..cb729e7e 100644
--- a/tests/unit/40-lib.sh
+++ b/tests/unit/40-lib.sh
@@ -72,7 +72,7 @@ refused "a line that is not key = value" "$work/t6/x86_64-core.conf"
 # The keys that set verify's trust root
 #---------------------------------------------------------------------------#
 # tag: aarch64
-IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:888ecb61a2ddd845b5f7172d98cb987290ad146d389d33e277a90e8571382381'
+IMG='ghcr.io/pkgforge-dev/archlinux:aarch64@sha256:05fefe98d4a7cfa0d428698ba4d3ea47d928c2665b66159d53827beb12a1d7b9'
 # trust NAME LINES...: a target file of x86_64 extra, with x86_64-core beside it
 trust() {
   local d="$work/trust-$1"