diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73366b2b..582eb1ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
             require: jq curl python3
           - leg: bash-gawk
             # tag: base
-            image: docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+            image: docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
             require: jq curl
           - leg: busybox
             # tag: 3.24
diff --git a/scripts/bench-consumer b/scripts/bench-consumer
index ba047672..17297b7c 100755
--- a/scripts/bench-consumer
+++ b/scripts/bench-consumer
@@ -57,7 +57,7 @@ trap 'printf "bench-consumer: line %s: \"%s\" ended %s\n" "$LINENO" "$BASH_COMMA
 export LC_ALL=C
 
 # tag: base
-ARCH_IMAGE=docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+ARCH_IMAGE=docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 ARCH="${BENCH_ARCH:-x86_64}"
diff --git a/targets/aarch64-alarm.conf b/targets/aarch64-alarm.conf
index d5dbc2d9..e493a16f 100644
--- a/targets/aarch64-alarm.conf
+++ b/targets/aarch64-alarm.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/aarch64-aur.conf b/targets/aarch64-aur.conf
index edc8d062..3e3d65a5 100644
--- a/targets/aarch64-aur.conf
+++ b/targets/aarch64-aur.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/aarch64-core.conf b/targets/aarch64-core.conf
index cd4bee0b..7868dc2e 100644
--- a/targets/aarch64-core.conf
+++ b/targets/aarch64-core.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/aarch64-extra.conf b/targets/aarch64-extra.conf
index d8fa4299..b25d40ea 100644
--- a/targets/aarch64-extra.conf
+++ b/targets/aarch64-extra.conf
@@ -27,7 +27,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the aarch64 image of
diff --git a/targets/armv7h-alarm.conf b/targets/armv7h-alarm.conf
index 3a953079..9428aa1d 100644
--- a/targets/armv7h-alarm.conf
+++ b/targets/armv7h-alarm.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/armv7h-aur.conf b/targets/armv7h-aur.conf
index 9421e16c..7489d86f 100644
--- a/targets/armv7h-aur.conf
+++ b/targets/armv7h-aur.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/armv7h-core.conf b/targets/armv7h-core.conf
index 2cffec86..ddf00734 100644
--- a/targets/armv7h-core.conf
+++ b/targets/armv7h-core.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/armv7h-extra.conf b/targets/armv7h-extra.conf
index 17911af4..2ab519d0 100644
--- a/targets/armv7h-extra.conf
+++ b/targets/armv7h-extra.conf
@@ -23,7 +23,7 @@ server = https://free.nchc.org.tw/archlinuxarm/$arch/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the armv7h image of
diff --git a/targets/loong64-core.conf b/targets/loong64-core.conf
index 37f0e396..f43dae3d 100644
--- a/targets/loong64-core.conf
+++ b/targets/loong64-core.conf
@@ -22,7 +22,7 @@ server = https://mirror.iscas.ac.cn/loongarch/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the loong64 image of
diff --git a/targets/loong64-extra.conf b/targets/loong64-extra.conf
index 49953505..8f48fab5 100644
--- a/targets/loong64-extra.conf
+++ b/targets/loong64-extra.conf
@@ -28,7 +28,7 @@ server = https://mirror.iscas.ac.cn/loongarch/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the loong64 image of
diff --git a/targets/powerpc-base-any.conf b/targets/powerpc-base-any.conf
index 4bd0b7d2..661af46c 100644
--- a/targets/powerpc-base-any.conf
+++ b/targets/powerpc-base-any.conf
@@ -14,7 +14,7 @@ db_server = https://repo.archlinuxpower.org/base/any
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # tag: ppc
diff --git a/targets/powerpc-base.conf b/targets/powerpc-base.conf
index 580ba5e0..8c79bfbc 100644
--- a/targets/powerpc-base.conf
+++ b/targets/powerpc-base.conf
@@ -13,7 +13,7 @@ db_server = https://repo.archlinuxpower.org/$repo/$arch
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # tag: ppc
diff --git a/targets/powerpc64-base-any.conf b/targets/powerpc64-base-any.conf
index 4c0bda94..944448a6 100644
--- a/targets/powerpc64-base-any.conf
+++ b/targets/powerpc64-base-any.conf
@@ -14,7 +14,7 @@ db_server = https://repo.archlinuxpower.org/base/any
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # tag: ppc64
diff --git a/targets/powerpc64-base.conf b/targets/powerpc64-base.conf
index 17a99802..856c793c 100644
--- a/targets/powerpc64-base.conf
+++ b/targets/powerpc64-base.conf
@@ -13,7 +13,7 @@ db_server = https://repo.archlinuxpower.org/$repo/$arch
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # tag: ppc64
diff --git a/targets/powerpc64le-base-any.conf b/targets/powerpc64le-base-any.conf
index 878accb1..3ea5331f 100644
--- a/targets/powerpc64le-base-any.conf
+++ b/targets/powerpc64le-base-any.conf
@@ -14,7 +14,7 @@ db_server = https://repo.archlinuxpower.org/base/any
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # tag: ppc64le
diff --git a/targets/powerpc64le-base.conf b/targets/powerpc64le-base.conf
index 285a797d..d27f29f5 100644
--- a/targets/powerpc64le-base.conf
+++ b/targets/powerpc64le-base.conf
@@ -13,7 +13,7 @@ db_server = https://repo.archlinuxpower.org/$repo/$arch
 db_signed = yes
 
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # tag: ppc64le
diff --git a/targets/riscv64-core.conf b/targets/riscv64-core.conf
index 5be5b876..0a936b1c 100644
--- a/targets/riscv64-core.conf
+++ b/targets/riscv64-core.conf
@@ -27,7 +27,7 @@ server = https://mirrors.sustech.edu.cn/archriscv/repo/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the riscv64 image of
diff --git a/targets/riscv64-extra.conf b/targets/riscv64-extra.conf
index 41325afe..1116dda5 100644
--- a/targets/riscv64-extra.conf
+++ b/targets/riscv64-extra.conf
@@ -32,7 +32,7 @@ server = https://mirrors.sustech.edu.cn/archriscv/repo/$repo
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root: the keyring files of the riscv64 image of
diff --git a/targets/x86_64-core.conf b/targets/x86_64-core.conf
index 835f47da..f22c4f84 100644
--- a/targets/x86_64-core.conf
+++ b/targets/x86_64-core.conf
@@ -22,7 +22,7 @@ server = https://mirrors.rit.edu/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root is the verify image's own keyring. The keyring package is
diff --git a/targets/x86_64-extra.conf b/targets/x86_64-extra.conf
index e73d636a..7bb43409 100644
--- a/targets/x86_64-extra.conf
+++ b/targets/x86_64-extra.conf
@@ -22,7 +22,7 @@ server = https://mirrors.rit.edu/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root is the verify image's own keyring. The keyring package is in
diff --git a/targets/x86_64-multilib.conf b/targets/x86_64-multilib.conf
index adb65e8d..a919904d 100644
--- a/targets/x86_64-multilib.conf
+++ b/targets/x86_64-multilib.conf
@@ -22,7 +22,7 @@ server = https://mirrors.rit.edu/archlinux/$repo/os/$arch
 # pacman verifies in the x86_64 Arch image, with Architecture set to the
 # target's arch: no emulation.
 # tag: base
-verify_image = docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+verify_image = docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 verify_platform = linux/amd64
 
 # The trust root is the verify image's own keyring. The keyring package is in
diff --git a/tests/integration/10-pipeline.sh b/tests/integration/10-pipeline.sh
index 86bf6222..56c2a8e2 100644
--- a/tests/integration/10-pipeline.sh
+++ b/tests/integration/10-pipeline.sh
@@ -33,7 +33,7 @@ set -euo pipefail
 . "$REPO_ROOT/tests/lib/harness.sh"
 
 # tag: base
-ARCH_IMAGE=docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+ARCH_IMAGE=docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 # tag: 3
 REGISTRY_IMAGE=docker.io/library/registry:3@sha256:38907510915c3f1604c7e83d6ab602ab3020d092f73bdaed8696773693ff768c
 # tag: 1.38
diff --git a/tests/integration/20-client.sh b/tests/integration/20-client.sh
index 4c699e57..a20122f8 100644
--- a/tests/integration/20-client.sh
+++ b/tests/integration/20-client.sh
@@ -22,7 +22,7 @@ set -euo pipefail
 . "$REPO_ROOT/tests/lib/harness.sh"
 
 # tag: base
-ARCH_IMAGE=docker.io/library/archlinux:base@sha256:b1c2fe6e717bfd5673af8fc217e1e1c3ce0dcbb1d53c3414c8425e7ce79fc6d9
+ARCH_IMAGE=docker.io/library/archlinux:base@sha256:d4594bb2300cba11f41c2f27923eb56f63d9988909c402f9c95517d1e362c899
 # tag: 3
 REGISTRY_IMAGE=docker.io/library/registry:3@sha256:38907510915c3f1604c7e83d6ab602ab3020d092f73bdaed8696773693ff768c
 # tag: 3.15-alpine