diff --git a/pgp/multisig-both.gpg b/pgp/multisig-both.gpg
index dd794b76..1cb44a82 100644
Binary files a/pgp/multisig-both.gpg and b/pgp/multisig-both.gpg differ
diff --git a/pgp/multisig-known-bad.signature b/pgp/multisig-known-bad.signature
index 113b8873..f763c2cd 100644
Binary files a/pgp/multisig-known-bad.signature and b/pgp/multisig-known-bad.signature differ
diff --git a/pgp/multisig-known-good.signature b/pgp/multisig-known-good.signature
index faf7d86e..e025ea04 100644
Binary files a/pgp/multisig-known-good.signature and b/pgp/multisig-known-good.signature differ
diff --git a/pgp/multisig-one.gpg b/pgp/multisig-one.gpg
index 6a24c6cc..c0604445 100644
Binary files a/pgp/multisig-one.gpg and b/pgp/multisig-one.gpg differ
diff --git a/pgp/multisig.clearsigned b/pgp/multisig.clearsigned
index 94d9531c..f94c9e3d 100644
--- a/pgp/multisig.clearsigned
+++ b/pgp/multisig.clearsigned
@@ -1,22 +1,21 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA256
+Hash: SHA512
 
 aptly multi-signature verification fixture
-
 -----BEGIN PGP SIGNATURE-----
 
-iQEzBAEBCAAdFiEEK14dkVdjQa9ExgDhMK0ohu1Yd1wFAmqYKJEACgkQMK0ohu1Y
-d1wi/Qf/du6Cfs5Og7jqNG17jUEMNO+ZTYfI60ytrcQ47BgX21zGorRWE6M9L6EJ
-YbgYptGRrSHrVIZJXWVVWsdWbTHG4pW5ph2cSeVjOQWGF7JqlqjJOmrbzrQo2FSs
-EwQiCloJ7sBRj7bVtf1ovkfFWp00wNO77ZHJK0vBCSf8v43V0BEykL25lvEG5KTG
-TO8k+Yh9hDo/0DkPQpp7b5k9IVOgJrnQn9NuW7iD62FeM8WKrhk6EAHDzhDD5jyT
-hf3ADA9nEc4i0bPVMwVXMHgW+Wmm6DtJxQYNlZrPzPLG7+1mpZN1OQBG0w/QnLsW
-p6o2Nh+xVwO5ko7uSUtTCrt2IGogk4kBMwQBAQgAHRYhBDLwA6IWaB1MyBD6IZi1
-MB6x+hMXBQJqmCiRAAoJEJi1MB6x+hMXZzgH/jHmAjbymQcvZ9HsQCIv7aN07sCr
-HtjgUPzaOsibn8NRQiXtVQqqDChaQi2brSqeTG2oNN2+buRNQAXwyEmtC7+6SdH3
-/lnH/7IpdqMRBBtmiAH5ny9DfgenWNWb8F2hAcoc00RugiDFFyVmlBfBXK5/l+KI
-DanIKW97TXXMA8J8KAe/asOXaht8oiW85dmAlSlrHRWZxOBTLR3540nMTD0/Cp5n
-i+ngQpqIzSykFQ/4scYVT4rc/Iu64yCV75O5fumQDrqMPqXfD+Lms4bFhQYxja8K
-uofxwhwHvz5xEGSDve/krZrD8JG7mMINZjjxIr5t83eKXcxhHd7BVUBj4yI=
-=ulCF
+iQEzBAEBCgAdFiEEqYoHYeLwl1cZL9VhhT6Gnff0SYYFAmrmaZIACgkQhT6Gnff0
+SYYKYAgAujy2QKb0Gjg9YSX16Ff5XCkd/XJSVwSHxVfX5TXN2daby+a3fns78Z9u
+gbNF8qB0n6P8Q8xpPvrvnx125yJidutBR77Y1fjBm5Ks6N/x1kWg9lIXwS5eYglA
+I7Ctm3vEdD96wyYnHiBOo9sufasrfX1CnCBd1q1MkDrNpaiYmvSMeK+f6Ozs7OK2
+IfYNB5dNsI/LI65bKbgGFiOXoqMlXYFDn9GA734jrk3CvOImks4Q9GEi/qhaPKHe
+sU9lZ9KU9Okj9Yy96c7Dk29iGaxhhKTiZ+2UGvyczVRenf2+v5t8/M11CgagApPP
+nq8MRgPBKk6BdMgMd0SyZZhPj0VEpokBMwQBAQoAHRYhBOyPYRMwLkNvKOuL0hPZ
+BG62qCWlBQJq5mmSAAoJEBPZBG62qCWlgv8H/1CEchjYZDgPWFu7cZE+abBPByTX
+VcYU62CQPBpkxJ00pviuKgYRzQX0FCxQxpQOQlHv3ToVzL3a62m1vrTRa3NhT0U8
+DYdRxcW8o/11hnY3VeiPavOvORhwn70FeBYtYw7BipHHxwOElh7Ey5dkzHS+Z2OL
+0kCNvltjKEFZM+q4w2yPbSpam7wCS5gYLl0d+99ornPtzDwBOreXFoC1MER3y1hB
+H3XbLqggE6gfumfiGR9Hljvh5CT/ebk7RwMWCcrp3/MdXwfpH+6JGg1AvF/TwmEi
+XAl8LljwTybylH+8wKAHYX4ed7GvJBOigJth+3o7sh8n7oqL0YJH0JoSjbM=
+=ThV5
 -----END PGP SIGNATURE-----
diff --git a/pgp/multisig.signature b/pgp/multisig.signature
index c9ef553f..21f33aad 100644
Binary files a/pgp/multisig.signature and b/pgp/multisig.signature differ
diff --git a/pgp/verify_test.go b/pgp/verify_test.go
index b2354f43..5529df4c 100644
--- a/pgp/verify_test.go
+++ b/pgp/verify_test.go
@@ -15,16 +15,25 @@ type VerifierSuite struct {
 	multisigBothVerifier Verifier
 }
 
-// The partial-keyring fixtures were generated with GnuPG 2.4:
+// The partial-keyring fixtures were generated with GnuPG 2.4 at a fixed time
+// so they remain valid under the CI faketime window (2025-01-02):
 //
-//	gpg --batch --pinentry-mode loopback --passphrase '' --quick-generate-key 'Aptly multisign known fixture <known@fixture.invalid>' rsa2048 sign 0
-//	gpg --batch --pinentry-mode loopback --passphrase '' --quick-generate-key 'Aptly multisign unknown fixture <unknown@fixture.invalid>' rsa2048 sign 0
-//	gpg --export 2B5E1D91576341AF44C600E130AD2886ED58775C 32F003A216681D4CC810FA2198B5301EB1FA1317 > multisig-both.gpg
-//	gpg --export 2B5E1D91576341AF44C600E130AD2886ED58775C > multisig-one.gpg
-//	gpg --local-user 2B5E1D91576341AF44C600E130AD2886ED58775C --local-user 32F003A216681D4CC810FA2198B5301EB1FA1317 --detach-sign --output multisig.signature multisig.text
-//	gpg --local-user 2B5E1D91576341AF44C600E130AD2886ED58775C --local-user 32F003A216681D4CC810FA2198B5301EB1FA1317 --clearsign --output multisig.clearsigned multisig.text
-//	gpg --local-user 2B5E1D91576341AF44C600E130AD2886ED58775C --detach-sign --output multisig-known-good.signature multisig.text
-//	gpg --local-user 32F003A216681D4CC810FA2198B5301EB1FA1317 --detach-sign --output multisig-known-bad.signature multisig-bad.text
+//	gpg --batch --pinentry-mode loopback --passphrase '' \
+//	  --faked-system-time 20250101T000000 \
+//	  --quick-generate-key 'Aptly multisign known fixture <known@fixture.invalid>' rsa2048 sign 0
+//	gpg --batch --pinentry-mode loopback --passphrase '' \
+//	  --faked-system-time 20250101T000000 \
+//	  --quick-generate-key 'Aptly multisign unknown fixture <unknown@fixture.invalid>' rsa2048 sign 0
+//	gpg --export <FPR_known> <FPR_unknown> > multisig-both.gpg
+//	gpg --export <FPR_known> > multisig-one.gpg
+//	gpg --local-user <FPR_known> --local-user <FPR_unknown> \
+//	  --detach-sign --output multisig.signature multisig.text
+//	gpg --local-user <FPR_known> --local-user <FPR_unknown> \
+//	  --clearsign --output multisig.clearsigned multisig.text
+//	gpg --local-user <FPR_known> --detach-sign --output multisig-known-good.signature multisig.text
+//	gpg --local-user <FPR_unknown> --detach-sign --output multisig-known-bad.signature multisig-bad.text
+//
+// Replace <FPR_known> and <FPR_unknown> with the actual fingerprints from step 2.
 //
 // multisig-bad.text was made by changing multisig.text after signing it.
 
@@ -58,7 +67,7 @@ func (s *VerifierSuite) TestVerifyClearsigned(c *C) {
 
 	keyInfo, err := s.multisigBothVerifier.VerifyClearsigned(clearsigned, false)
 	c.Assert(err, IsNil)
-	c.Check(keyInfo.GoodKeys, DeepEquals, []Key{"30AD2886ED58775C", "98B5301EB1FA1317"})
+	c.Check(keyInfo.GoodKeys, DeepEquals, []Key{"853E869DF7F44986", "13D9046EB6A825A5"})
 	c.Check(keyInfo.MissingKeys, DeepEquals, []Key(nil))
 }
 
@@ -69,8 +78,8 @@ func (s *VerifierSuite) TestVerifyClearsignedPartialKeyring(c *C) {
 
 	keyInfo, err := s.multisigOneVerifier.VerifyClearsigned(clearsigned, false)
 	c.Assert(err, IsNil)
-	c.Check(keyInfo.GoodKeys, DeepEquals, []Key{"30AD2886ED58775C"})
-	c.Check(keyInfo.MissingKeys, DeepEquals, []Key{"98B5301EB1FA1317"})
+	c.Check(keyInfo.GoodKeys, DeepEquals, []Key{"853E869DF7F44986"})
+	c.Check(keyInfo.MissingKeys, DeepEquals, []Key{"13D9046EB6A825A5"})
 }
 
 func (s *VerifierSuite) TestVerifyDetachedPartialKeyring(c *C) {