diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 209d615359..76445da7f9 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -304,6 +304,14 @@ jobs:
           name: kotsadm-melange-packages-${{ matrix.runner.arch }}
           path: ./packages
 
+      - name: rename melange.rsa.pub # generated by the melange-build action
+        run: mv melange.rsa.pub melange-${{ matrix.runner.arch }}.rsa.pub
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kotsadm-melange-rsa-pub-${{ matrix.runner.arch }}
+          path: ./melange-${{ matrix.runner.arch }}.rsa.pub
+
 
   build-kotsadm:
     runs-on: ubuntu-20.04
@@ -316,16 +324,19 @@ jobs:
 
       - uses: actions/download-artifact@v4
         with:
-          name: kotsadm-melange-packages-amd64
+          pattern: kotsadm-melange-packages-*
           path: ./packages/
+          merge-multiple: true
 
       - uses: actions/download-artifact@v4
         with:
-          name: kotsadm-melange-packages-arm64
-          path: ./packages/
+          pattern: kotsadm-melange-rsa-pub-*
+          merge-multiple: true
 
-      - name: list packages
-        run: ls -lah packages
+      - name: list downloaded artifacts
+        run: |
+          ls -lah
+          ls -lah packages
 
       - name: template apko config
         env:
diff --git a/deploy/apko.yaml.tmpl b/deploy/apko.yaml.tmpl
index 90b5e9f895..efe2bb8599 100644
--- a/deploy/apko.yaml.tmpl
+++ b/deploy/apko.yaml.tmpl
@@ -4,7 +4,8 @@ contents:
     - ./packages/
   keyring:
     - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-    - ./melange.rsa.pub
+    - ./melange-arm64.rsa.pub
+    - ./melange-amd64.rsa.pub
   packages:
     - kotsadm-head  # This is expected to be built locally by `melange`.
     - kubectl