diff --git a/.forgejo/workflows/sign.yml b/.forgejo/workflows/sign.yml
index 36410da..0a86dd5 100644
--- a/.forgejo/workflows/sign.yml
+++ b/.forgejo/workflows/sign.yml
@@ -174,8 +174,19 @@ jobs:
         # Sanity-check: the freshly-signed bundle must verify
         # against the well-known public key before we publish it.
         run: |
-          curl -fsSL https://git.flemming.ai/fai/chain-private/raw/branch/main/infra/cosign/official.pub \
-            -o /tmp/official.pub
+          # official.pub is embedded verbatim (same pattern as the
+          # platform's sync-mirror.sh): the dev repo is private, so
+          # an anonymous raw fetch 404s — this step could never have
+          # passed since the repo went private. It is the PUBLIC
+          # half of the signing key; embedding it is safe and makes
+          # the workflow self-contained. Keep in lockstep with
+          # fai/chain-private infra/cosign/official.pub on rotation.
+          cat > /tmp/official.pub <<'PEM'
+          -----BEGIN PUBLIC KEY-----
+          MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8SsjXx7VcvjvEbg4qrTag2GRn4kL
+          PUCZm85YCe0udF5qqKep1aeaTjmkvm9UutlDW+bUmtVSC54Qme5h3NNkFA==
+          -----END PUBLIC KEY-----
+          PEM
           openssl dgst -sha256 \
             -verify /tmp/official.pub \
             -signature <(base64 -d < "${{ steps.pack.outputs.bundle }}.sig") \