diff --git a/install.sh b/install.sh
index 3314ec0..8913f5e 100644
--- a/install.sh
+++ b/install.sh
@@ -28,7 +28,7 @@ NO_VERIFY_SIG=0
 # paste the public key here AND into libreportal.pub. While it contains REPLACE_ME,
 # signature verification is skipped (the sha256 still runs); once replaced, a valid
 # signature becomes REQUIRED for release installs.
-LP_MINISIGN_PUBKEY="RWREPLACE_ME_run_minisign_-G_then_paste_the_public_key_here_and_in_install.sh"
+LP_MINISIGN_PUBKEY="RWRBf8o+a1KSvF08fA3oKrVz/71D60YeF4GO66ntVeJvzAkI57sjgM1S"
 
 usage() {
     sed -n '3,12p' "$0" | sed 's/^# \{0,1\}//'
diff --git a/libreportal.pub b/libreportal.pub
index 896cf4c..4c1b36c 100644
--- a/libreportal.pub
+++ b/libreportal.pub
@@ -1,2 +1,2 @@
-untrusted comment: LibrePortal release signing key — REPLACE_ME (run `minisign -G`)
-RWREPLACE_ME_run_minisign_-G_then_paste_the_public_key_here_and_in_install.sh
+untrusted comment: LibrePortal release signing key (id BC92526B3ECA7F41)
+RWRBf8o+a1KSvF08fA3oKrVz/71D60YeF4GO66ntVeJvzAkI57sjgM1S