diff --git a/aios.gpg b/aios.gpg
new file mode 100644
index 0000000..c12a19b
Binary files /dev/null and b/aios.gpg differ
diff --git a/build.zsh b/build.zsh
index 659f271..4ae7e97 100755
--- a/build.zsh
+++ b/build.zsh
@@ -5,6 +5,7 @@ set -e
 ROOTFS="$(pwd)/root.x86_64"
 BUILD_MODE="${1:-tarball}"
 BUILD_DATE=$(date +%Y.%m.%d)
+GPG_KEY=B6A582E551A2F6181A5CC99E338E6F42F9544D9B
 
 echo "=== aios build $BUILD_DATE (mode: $BUILD_MODE) ==="
 
@@ -24,13 +25,6 @@ echo 'Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch' > $ROOTFS/etc/pac
 sed -i 's/CheckSpace/#CheckSpace/' $ROOTFS/etc/pacman.conf
 sed -i '/\[options\]/a NoUpgrade = etc/os-release' $ROOTFS/etc/pacman.conf
 
-cat >> $ROOTFS/etc/pacman.conf <<'EOF'
-
-[aios]
-SigLevel = Optional TrustAll
-Server = https://git.syui.ai/ai/repo/raw/branch/main/$arch
-EOF
-
 arch-chroot $ROOTFS /bin/sh -c 'pacman-key --init && pacman-key --populate archlinux'
 arch-chroot $ROOTFS /bin/sh -c 'pacman -Syu --noconfirm base-devel vim git zsh rust clang openssh jq nodejs npm zsh-autosuggestions zsh-syntax-highlighting zsh-history-substring-search'
 
@@ -40,7 +34,19 @@ fi
 
 arch-chroot $ROOTFS /bin/sh -c 'npm i -g @anthropic-ai/claude-code'
 
-arch-chroot $ROOTFS /bin/sh -c 'pacman -Sy --noconfirm ailog aigpt aishell'
+cat >> $ROOTFS/etc/pacman.conf <<'EOF'
+
+[aios]
+SigLevel = Required DatabaseOptional
+Server = https://git.syui.ai/ai/repo/raw/branch/main/$arch
+EOF
+
+arch-chroot $ROOTFS /bin/sh -c "
+  # curl -sL https://git.syui.ai/ai/repo/raw/branch/main/aios.gpg -o /tmp/aios.gpg
+  pacman-key --add ./aios.gpg
+  pacman-key --lsign-key $GPG_KEY
+"
+arch-chroot $ROOTFS /bin/sh -c 'pacman -S --noconfirm ailog aigpt aishell'
 
 arch-chroot $ROOTFS /bin/sh -c 'chsh -s /bin/zsh'
 arch-chroot $ROOTFS /bin/sh -c 'useradd -m -G wheel -s /bin/zsh ai'