diff --git a/roles/float-base/tasks/apt.yml b/roles/float-base/tasks/apt.yml
index 1c05f4e7b7437b05015a4076e88291e10793c904..806ede353580206db18db8daf5f9b7879b86f660 100644
--- a/roles/float-base/tasks/apt.yml
+++ b/roles/float-base/tasks/apt.yml
@@ -28,10 +28,13 @@
 
 - name: Setup apt trusted keyring
   copy:
-    src: "apt/{{ item }}"
-    dest: "/etc/apt/trusted.gpg.d/{{ item }}"
-  with_items:
-    - deb_autistici_org.gpg
+    src: "apt/deb_autistici_org.gpg"
+    dest: "/usr/share/keyrings/deb.autistici.org.gpg"
+
+- name: Remove legacy apt keyring
+  file:
+    path: "/etc/apt/trusted.gpg.d/deb_autistici_org.gpg"
+    state: absent
 
 - name: Install our standard sources.list
   template:
@@ -40,7 +43,7 @@
 
 - name: Install package repositories
   apt_repository:
-    repo: "deb http://deb.autistici.org/urepo ai3/"
+    repo: "deb [signed-by=/usr/share/keyrings/deb.autistici.org.gpg] http://deb.autistici.org/urepo float/{{ float_debian_dist }}"
     state: present
 
 - name: Run apt-get update