diff --git a/scripts/apk/ci-build.sh b/scripts/apk/ci-build.sh
index 1efe182..1833f17 100755
--- a/scripts/apk/ci-build.sh
+++ b/scripts/apk/ci-build.sh
@@ -31,6 +31,15 @@ export PACKAGER="${packager}"
 export REPODEST="${repo_root}/packages"
 export SRCDEST="${repo_root}/.cache/apk-distfiles"
 
+install_repo_keys() {
+  local key
+  shopt -s nullglob
+  for key in "${REPODEST}/${repo_name}"/*/*.rsa.pub; do
+    doas cp "${key}" /etc/apk/keys/
+  done
+  shopt -u nullglob
+}
+
 git config --global --add safe.directory "${repo_root}"
 mkdir -p "${repo_root}/.cache/abuild" "${SRCDEST}" "${REPODEST}" "${HOME}/.abuild"
 
@@ -44,6 +53,7 @@ if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
 fi
 
 doas cp "${HOME}"/.abuild/*.rsa.pub /etc/apk/keys/
+install_repo_keys
 doas apk update
 
 while IFS= read -r package_dir; do
diff --git a/scripts/apk/container-entrypoint.sh b/scripts/apk/container-entrypoint.sh
index 01b42a9..979cf08 100755
--- a/scripts/apk/container-entrypoint.sh
+++ b/scripts/apk/container-entrypoint.sh
@@ -15,6 +15,15 @@ fi
 git config --global --add safe.directory /work
 mkdir -p /home/builder/.abuild /home/builder/packages "${package_dir}"
 
+install_repo_keys() {
+  local key
+  shopt -s nullglob
+  for key in "/home/builder/packages/${repo_name}"/*/*.rsa.pub; do
+    doas cp "${key}" /etc/apk/keys/
+  done
+  shopt -u nullglob
+}
+
 if [[ -n "${PACKAGER_PRIVKEY:-}" && ! -f "${PACKAGER_PRIVKEY}" ]]; then
   abuild-keygen -a -n
 elif ! compgen -G "/home/builder/.abuild/*.rsa" > /dev/null; then
@@ -34,6 +43,7 @@ if [[ -n "${PACKAGER_PRIVKEY:-}" && -f "${PACKAGER_PRIVKEY}.pub" ]]; then
 elif compgen -G "/home/builder/.abuild/*.rsa.pub" > /dev/null; then
   doas cp /home/builder/.abuild/*.rsa.pub /etc/apk/keys/
 fi
+install_repo_keys
 
 case "${command_name}" in
   build)