diff --git a/.github/setup-runner-keys.sh b/.github/setup-runner-keys.sh
new file mode 100755
index 00000000..3843c2a8
--- /dev/null
+++ b/.github/setup-runner-keys.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Setup Public Keys for containers that are pulled during the build
+
+set -eoux pipefail
+
+PKI_DIR="/etc/pki/containers"
+REGISTRIES="/etc/containers/registries.d"
+
+mkdir -p "${PKI_DIR}" "${REGISTRIES}"
+cp cosign.pub "${PKI_DIR}/ghcr.io-ublue-os.pub"
+cp quay.io-fedora-ostree-desktops.pub "${PKI_DIR}"
+
+yq -n '.docker."ghcr.io/ublue-os".use-sigstore-attachments = true' | tee "${REGISTRIES}"/ublue-os.yaml
+yq -n '.docker."quay.io/fedora-ostree-desktops".use-sigstore-attachments = true' | tee "${REGISTRIES}"/fedora-ostree-desktops.yaml
+
+jq '.transports.docker["ghcr.io/ublue-os"] = [
+  {
+    "type": "sigstoreSigned",
+    "keyPath": "/etc/pki/containers/ghcr.io-ublue-os.pub",
+    "signedIdentity": {
+      "type": "matchRepository"
+    }
+  }
+] |
+.transports.docker["quay.io/fedora-ostree-desktops"] = [
+  {
+    "type": "sigstoreSigned",
+    "keyPath": "/etc/pki/containers/quay.io-fedora-ostree-desktops.pub",
+    "signedIdentity": {
+      "type": "matchRepository"
+    }
+  }
+]' /etc/containers/policy.json | tee /etc/containers/policy.json.tmp > /dev/null && mv /etc/containers/policy.json.tmp /etc/containers/policy.json
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index b10f73de..d9ec7e36 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -85,6 +85,10 @@ jobs:
         id: remove-unwanted-software
         uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6
 
+      - name: Configure containers policy for build
+        run: |
+          sudo ./.github/setup-runner-keys.sh
+
       - name: Install Just
         run: |
           /home/linuxbrew/.linuxbrew/bin/brew install just
@@ -93,7 +97,6 @@ jobs:
       # FIXME: Implement retries for stuff like this
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-        if: inputs.publish
 
       - name: Install ORAS
         uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
diff --git a/Justfile b/Justfile
index 4fe9f381..026991a7 100644
--- a/Justfile
+++ b/Justfile
@@ -144,7 +144,6 @@ build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false
 
     BASE_IMAGE_REF="${base_image_org}/${base_image_name}:${fedora_version}"
     ALL_IMAGES=()
-    {{ just }} verify-container quay.io-fedora-ostree-desktops.pub "${BASE_IMAGE_REF}"
     ALL_IMAGES+=("${BASE_IMAGE_REF}")
 
     # Here we pin our kernels to workaround regressions!
@@ -187,18 +186,15 @@ build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false
     BASENAME_AKMODS="ghcr.io/ublue-os/akmods"
 
     AKMODS="${BASENAME_AKMODS}:${akmods_flavor}-${fedora_version}-${kernel_release}"
-    {{ just }} verify-container cosign.pub "${AKMODS}"
     ALL_IMAGES+=("${AKMODS}")
 
     if [[ "${akmods_flavor}" =~ coreos ]]; then
         AKMODS_ZFS="${BASENAME_AKMODS}-zfs:${akmods_flavor}-${fedora_version}-${kernel_release}"
-        {{ just }} verify-container cosign.pub "${AKMODS_ZFS}"
         ALL_IMAGES+=("${AKMODS_ZFS}")
     fi
 
     if [[ "${flavor}" =~ nvidia-open ]]; then
         AKMODS_NVIDIA_OPEN="${BASENAME_AKMODS}-nvidia-open:${akmods_flavor}-${fedora_version}-${kernel_release}"
-        {{ just }} verify-container cosign.pub "${AKMODS_NVIDIA_OPEN}"
         ALL_IMAGES+=("${AKMODS_NVIDIA_OPEN}")
     fi
 
@@ -216,7 +212,6 @@ build $image="aurora" $tag="latest" $flavor="main" $rechunk="false" $ghcr="false
 
     ALL_IMAGES+=("{{ chunkah }}")
 
-    {{ just }} verify-container cosign.pub "{{ brew }}"
     ALL_IMAGES+=("{{ brew }}")
 
     {{ retry_function }}
@@ -482,33 +477,6 @@ changelogs branch="stable" handwritten="":
     set -eou pipefail
     python3 ./.github/changelogs.py "{{ branch }}" ./output.env ./changelog.md --workdir . --handwritten "{{ handwritten }}"
 
-# Verify Container with Cosign
-[group('Utility')]
-verify-container key="" container="":
-    #!/usr/bin/env bash
-    set -eou pipefail
-
-    # Get Cosign if Needed
-    if [[ ! $(command -v cosign) ]]; then
-        COSIGN_CONTAINER_ID=$(${SUDOIF} ${PODMAN} create cgr.dev/chainguard/cosign:latest bash)
-        ${SUDOIF} ${PODMAN} cp "${COSIGN_CONTAINER_ID}":/usr/bin/cosign /usr/local/bin/cosign
-        ${SUDOIF} ${PODMAN} rm -f "${COSIGN_CONTAINER_ID}"
-    fi
-
-    # Verify Cosign Image Signatures if needed
-    if [[ -n "${COSIGN_CONTAINER_ID:-}" ]]; then
-        if ! cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main cgr.dev/chainguard/cosign >/dev/null; then
-            echo "NOTICE: Failed to verify cosign image signatures."
-            exit 1
-        fi
-    fi
-
-    # Verify Container using cosign public key
-    if ! cosign verify --key "{{ key }}" "{{ container }}" >/dev/null; then
-        echo "NOTICE: Verification failed. Please ensure your public key is correct."
-        exit 1
-    fi
-
 # Secureboot Check
 [arg("flavor", long="flavor", short="f")]
 [arg("image", long="image", short="i")]