diff --git a/.github/actions/build-push-kotsadm-image/action.yml b/.github/actions/build-push-kotsadm-image/action.yml
index 6abb935333..9baaa63ca4 100644
--- a/.github/actions/build-push-kotsadm-image/action.yml
+++ b/.github/actions/build-push-kotsadm-image/action.yml
@@ -1,10 +1,6 @@
 name: 'Build and push kotsadm image'
 description: 'Composite action for building and pushing kotsadm image'
 inputs:
-  workspace:
-    description: 'Github workspace'
-    required: true
-
   chainguard-gcp-wif-pool:
     description: 'GCP workload identity pool for Chainguard'
     required: true
@@ -73,7 +69,6 @@ runs:
         archs: x86_64
         sign-with-temporary-key: true
         cache-dir: ${{ steps.cache-dir.outputs.cache_dir }}
-        keyring-append: ${{ inputs.workspace }}/packages/chainguard-enterprise.rsa.pub
 
     - uses: chainguard-images/actions/apko-publish@main
       with:
diff --git a/deploy/apko.yaml.tmpl b/deploy/apko.yaml.tmpl
index 276ab70a76..1b624bd1ac 100644
--- a/deploy/apko.yaml.tmpl
+++ b/deploy/apko.yaml.tmpl
@@ -4,6 +4,7 @@ contents:
     - ./packages/
   keyring:
     - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
+    - ./packages/chainguard-enterprise.rsa.pub
     - ./melange.rsa.pub
   packages:
     - kotsadm-head  # This is expected to be built locally by `melange`.
diff --git a/deploy/melange.yaml.tmpl b/deploy/melange.yaml.tmpl
index 8f38f6553a..f86388720f 100644
--- a/deploy/melange.yaml.tmpl
+++ b/deploy/melange.yaml.tmpl
@@ -12,7 +12,6 @@ environment:
       - https://packages.wolfi.dev/os
     keyring:
       - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-      - ./packages/chainguard-enterprise.rsa.pub
     packages:
       - ca-certificates-bundle
       - busybox