diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index 4bb4297..ee9af78 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -13,8 +13,11 @@ jobs:
     steps:
       - name: Install build dependencies
         run: |
-          pacman -Sy --noconfirm
-          pacman -S --noconfirm --needed \
+          # archlinux:latest images ship a snapshot keyring; new packages
+          # signed after that snapshot fail PGP verification. Refresh the
+          # keyring first, then everything else.
+          pacman -Sy --noconfirm archlinux-keyring
+          pacman -Syu --noconfirm --needed \
             base-devel git zip tar \
             clang lld libc++ cmake \
             mingw-w64-gcc \