diff --git a/scripts/lib/setup-apt-repo b/scripts/lib/setup-apt-repo
index 39c1d91a31..63013231c1 100755
--- a/scripts/lib/setup-apt-repo
+++ b/scripts/lib/setup-apt-repo
@@ -98,7 +98,7 @@ if ! apt-get -dy install "${pre_setup_deps[@]}"; then
 fi
 apt-get -y install "${pre_setup_deps[@]}"
 
-apt-key add "$LIST_PATH/"*.asc
+cp "$LIST_PATH/"*.asc /etc/apt/keyrings/
 cp "$LIST_PATH/$release.list" "$SOURCES_FILE"
 
 if [ -e "$LIST_PATH/custom.sh" ]; then
diff --git a/scripts/setup/apt-repos/ksplice/jammy.list b/scripts/setup/apt-repos/ksplice/jammy.list
index 6822fb3c2e..d48803e79c 100644
--- a/scripts/setup/apt-repos/ksplice/jammy.list
+++ b/scripts/setup/apt-repos/ksplice/jammy.list
@@ -1,2 +1,2 @@
-deb http://www.ksplice.com/apt jammy ksplice
-deb-src http://www.ksplice.com/apt jammy ksplice
+deb [signed-by=/etc/apt/keyrings/ksplice.asc] http://www.ksplice.com/apt jammy ksplice
+deb-src [signed-by=/etc/apt/keyrings/ksplice.asc] http://www.ksplice.com/apt jammy ksplice
diff --git a/scripts/setup/apt-repos/ksplice/noble.list b/scripts/setup/apt-repos/ksplice/noble.list
index 354df06587..6a85f9950f 100644
--- a/scripts/setup/apt-repos/ksplice/noble.list
+++ b/scripts/setup/apt-repos/ksplice/noble.list
@@ -1,2 +1,2 @@
-deb http://www.ksplice.com/apt noble ksplice
-deb-src http://www.ksplice.com/apt noble ksplice
+deb [signed-by=/etc/apt/keyrings/ksplice.asc] http://www.ksplice.com/apt noble ksplice
+deb-src [signed-by=/etc/apt/keyrings/ksplice.asc] http://www.ksplice.com/apt noble ksplice
diff --git a/scripts/setup/apt-repos/teleport/jammy.list b/scripts/setup/apt-repos/teleport/jammy.list
index 935d4fca8f..69c5234449 100644
--- a/scripts/setup/apt-repos/teleport/jammy.list
+++ b/scripts/setup/apt-repos/teleport/jammy.list
@@ -1 +1 @@
-deb https://apt.releases.teleport.dev/ubuntu jammy stable/v17
+deb [signed-by=/etc/apt/keyrings/teleport-pubkey.asc] https://apt.releases.teleport.dev/ubuntu jammy stable/v17
diff --git a/scripts/setup/apt-repos/teleport/noble.list b/scripts/setup/apt-repos/teleport/noble.list
index 6a1786e067..9858905b1e 100644
--- a/scripts/setup/apt-repos/teleport/noble.list
+++ b/scripts/setup/apt-repos/teleport/noble.list
@@ -1 +1 @@
-deb https://apt.releases.teleport.dev/ubuntu noble stable/v17
+deb [signed-by=/etc/apt/keyrings/teleport-pubkey.asc] https://apt.releases.teleport.dev/ubuntu noble stable/v17
diff --git a/scripts/setup/apt-repos/zulip/bookworm.list b/scripts/setup/apt-repos/zulip/bookworm.list
index 308554e033..bc31581c01 100644
--- a/scripts/setup/apt-repos/zulip/bookworm.list
+++ b/scripts/setup/apt-repos/zulip/bookworm.list
@@ -1,5 +1,5 @@
-deb http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main
-deb-src http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main
+deb [signed-by=/etc/apt/keyrings/pgdg.asc] http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main
+deb-src [signed-by=/etc/apt/keyrings/pgdg.asc] http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main
 
 deb http://deb.debian.org/debian bookworm-backports main
 deb-src http://deb.debian.org/debian bookworm-backports main
diff --git a/scripts/setup/apt-repos/zulip/jammy.list b/scripts/setup/apt-repos/zulip/jammy.list
index 3511af4b0b..cf42ddbb06 100644
--- a/scripts/setup/apt-repos/zulip/jammy.list
+++ b/scripts/setup/apt-repos/zulip/jammy.list
@@ -1,11 +1,11 @@
-deb http://apt.postgresql.org/pub/repos/apt/ jammy-pgdg main
-deb-src http://apt.postgresql.org/pub/repos/apt/ jammy-pgdg main
+deb [signed-by=/etc/apt/keyrings/pgdg.asc] http://apt.postgresql.org/pub/repos/apt/ jammy-pgdg main
+deb-src [signed-by=/etc/apt/keyrings/pgdg.asc] http://apt.postgresql.org/pub/repos/apt/ jammy-pgdg main
 
-deb http://ppa.launchpad.net/groonga/ppa/ubuntu jammy main
-deb-src http://ppa.launchpad.net/groonga/ppa/ubuntu jammy main
+deb [signed-by=/etc/apt/keyrings/pgroonga-ppa.asc] http://ppa.launchpad.net/groonga/ppa/ubuntu jammy main
+deb-src [signed-by=/etc/apt/keyrings/pgroonga-ppa.asc] http://ppa.launchpad.net/groonga/ppa/ubuntu jammy main
 
-deb https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ jammy main
-deb-src https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ jammy main
+deb [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ jammy main
+deb-src [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ jammy main
 
-deb https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ jammy main
-deb-src https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ jammy main
+deb [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ jammy main
+deb-src [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ jammy main
diff --git a/scripts/setup/apt-repos/zulip/noble.list b/scripts/setup/apt-repos/zulip/noble.list
index 8a3c3e072b..535c40cf7c 100644
--- a/scripts/setup/apt-repos/zulip/noble.list
+++ b/scripts/setup/apt-repos/zulip/noble.list
@@ -1,12 +1,12 @@
-deb http://apt.postgresql.org/pub/repos/apt/ noble-pgdg main
-deb-src http://apt.postgresql.org/pub/repos/apt/ noble-pgdg main
+deb [signed-by=/etc/apt/keyrings/pgdg.asc] http://apt.postgresql.org/pub/repos/apt/ noble-pgdg main
+deb-src [signed-by=/etc/apt/keyrings/pgdg.asc] http://apt.postgresql.org/pub/repos/apt/ noble-pgdg main
 
-deb http://ppa.launchpad.net/groonga/ppa/ubuntu noble main
-deb-src http://ppa.launchpad.net/groonga/ppa/ubuntu noble main
+deb [signed-by=/etc/apt/keyrings/pgroonga-ppa.asc] http://ppa.launchpad.net/groonga/ppa/ubuntu noble main
+deb-src [signed-by=/etc/apt/keyrings/pgroonga-ppa.asc] http://ppa.launchpad.net/groonga/ppa/ubuntu noble main
 
-deb https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ noble main
-deb-src https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ noble main
+deb [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ noble main
+deb-src [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libheif/ubuntu/ noble main
 
 # libde265 in 24.04 is up-to-date, so the PPA doesn't provide 24.04 packages
-#deb https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ noble main
-#deb-src https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ noble main
+#deb [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ noble main
+#deb-src [signed-by=/etc/apt/keyrings/strukturag.asc] https://ppa.launchpadcontent.net/strukturag/libde265/ubuntu/ noble main