diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 1370a51..64be076 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -70,7 +70,7 @@ jobs:
       # auditor would use. Catches a key/host mismatch BEFORE it ships, rather
       # than as every host in the field silently rejecting the catalog.
       - name: Verify signature
-        run: bun run verify -- --pub "${{ vars.INDEX_PUBLIC_KEY || 'ed25519:qK18TE2qygIyObtMlHxUI/G1gKby8tPxuieAfnEKgYE=' }}"
+        run: bun run verify -- --pub "${{ vars.INDEX_PUBLIC_KEY || 'ed25519:V7KKMg8sq2A2TW7D/GFWaM0ruAvigpld9r93JdWcQHw=' }}"
 
       - name: Commit signature to main
         run: |
diff --git a/README.md b/README.md
index 203f551..4694882 100644
--- a/README.md
+++ b/README.md
@@ -230,7 +230,7 @@ PR cannot get anything signed.
 The public key currently pinned in the host:
 
 ```
-ed25519:qK18TE2qygIyObtMlHxUI/G1gKby8tPxuieAfnEKgYE=
+ed25519:V7KKMg8sq2A2TW7D/GFWaM0ruAvigpld9r93JdWcQHw=
 ```
 
 `bun run verify` defaults to this key, so anyone can audit a published index
diff --git a/tools/keys.ts b/tools/keys.ts
index 3da43ee..207c2bd 100644
--- a/tools/keys.ts
+++ b/tools/keys.ts
@@ -22,7 +22,7 @@ export const PUBKEY_PREFIX = "ed25519:";
  * `verify` defaults to this so a signed index can be checked with no arguments.
  */
 export const DEFAULT_PUBLIC_KEY =
-  "ed25519:qK18TE2qygIyObtMlHxUI/G1gKby8tPxuieAfnEKgYE=";
+  "ed25519:V7KKMg8sq2A2TW7D/GFWaM0ruAvigpld9r93JdWcQHw=";
 
 /** Encode a node KeyObject public key as the host's `ed25519:<base64>` form. */
 export function encodePublicKey(key: KeyObject): string {