diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6e66ed2..cc3c704 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,6 +46,24 @@ jobs:
         cd repo/antergos-pkgs/os/x86_64
         repo-add antergos-pkgs.db.tar.gz *.pkg.tar.zst
 
+    - name: Sign repo database
+      env:
+        SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+        SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
+      run: |
+        if [[ -n "$SIGNING_KEY" && -n "$SIGNING_PASSPHRASE" ]]; then
+          export GNUPGHOME=/tmp/gpg-sign
+          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
+          echo "$SIGNING_KEY" | base64 -d > /tmp/signing-key.gpg
+          gpg --batch --import /tmp/signing-key.gpg
+          cd repo/antergos-pkgs/os/x86_64
+          gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSPHRASE" \
+            --detach-sign --output antergos-pkgs.db.tar.gz.sig antergos-pkgs.db.tar.gz
+          rm -rf "$GNUPGHOME" /tmp/signing-key.gpg
+        else
+          echo "Signing secrets not set — skipping signature"
+        fi
+
     - name: Copy to root for flat-URL compat
       run: |
         cp repo/antergos-pkgs/os/x86_64/*.pkg.tar.zst repo/
diff --git a/packages/antergos-next-keyring/PKGBUILD b/packages/antergos-next-keyring/PKGBUILD
index 3aa81f2..6e8e430 100644
--- a/packages/antergos-next-keyring/PKGBUILD
+++ b/packages/antergos-next-keyring/PKGBUILD
@@ -2,7 +2,7 @@
 
 pkgname=antergos-next-keyring
 pkgver=1
-pkgrel=2
+pkgrel=3
 pkgdesc="Antergos NeXT GPG keyring"
 arch=('any')
 url="https://github.com/Antergos-NeXT/antergos-packages"
diff --git a/packages/antergos-next-keyring/antergos-next-trusted b/packages/antergos-next-keyring/antergos-next-trusted
index fc4a315..5a81062 100644
--- a/packages/antergos-next-keyring/antergos-next-trusted
+++ b/packages/antergos-next-keyring/antergos-next-trusted
@@ -1 +1 @@
-F1D8F02C5E929F3FE0424EE897F813D238CF0DBB:4:
+AA644A095D2AF5F950FADB57C51BFE8D3A985236:4:
diff --git a/packages/antergos-next-keyring/antergos-next.gpg b/packages/antergos-next-keyring/antergos-next.gpg
index edbe66b..8e5583e 100644
Binary files a/packages/antergos-next-keyring/antergos-next.gpg and b/packages/antergos-next-keyring/antergos-next.gpg differ
diff --git a/setup-repo.sh b/setup-repo.sh
index 4aff294..9fbe0b5 100644
--- a/setup-repo.sh
+++ b/setup-repo.sh
@@ -14,7 +14,7 @@ if ! grep -q "\[antergos-pkgs\]" /etc/pacman.conf; then
     cat >> /etc/pacman.conf << 'CONF'
 
 [antergos-pkgs]
-SigLevel = Optional TrustAll
+SigLevel = DatabaseRequired PackageOptional
 Server = https://antergos-next.github.io/antergos-packages/
 CONF
     echo "Added antergos-pkgs to pacman.conf"
@@ -22,6 +22,9 @@ else
     echo "antergos-pkgs already in pacman.conf"
 fi
 
+pacman-key --init 2>/dev/null || true
+pacman-key --populate antergos-next 2>/dev/null || true
+
 pacman -Sy
 
 echo "Antergos NeXT PKGS ready!"