diff --git a/iso_files/build.sh b/iso_files/build.sh
index 4854538..d72e856 100755
--- a/iso_files/build.sh
+++ b/iso_files/build.sh
@@ -71,7 +71,8 @@ bash \
   "$SCRIPT_DIR/flatpak-mount-workaround.sh" && \
   "$SCRIPT_DIR/plasma-tweaks.sh" && \
   "$SCRIPT_DIR/workarounds.sh" && \
-  "$SCRIPT_DIR/configure_iso_anaconda.sh"
+  "$SCRIPT_DIR/configure_iso_anaconda.sh" && \
+  "$SCRIPT_DIR/smoke-tests.sh"
 
 # image-builder needs gcdx64.efi / grub modules
 _arch=$(uname -m)
diff --git a/iso_files/configure_iso_anaconda.sh b/iso_files/configure_iso_anaconda.sh
index 2a4503b..80b4c32 100755
--- a/iso_files/configure_iso_anaconda.sh
+++ b/iso_files/configure_iso_anaconda.sh
@@ -88,17 +88,13 @@ sync
 %end
 EOF
 
-# Fetch the Secureboot Public Key
-sbkey='https://github.com/ublue-os/akmods/raw/main/certs/public_key.der'
-curl --retry 15 -Lo /etc/sb_pubkey.der "$sbkey"
-
 # Enroll Secureboot Key
 tee /usr/share/anaconda/post-scripts/secureboot-enroll-key.ks <<'EOF'
 %post --erroronfail --nochroot
 set -oue pipefail
 
 readonly ENROLLMENT_PASSWORD="universalblue"
-readonly SECUREBOOT_KEY="/etc/sb_pubkey.der"
+readonly SECUREBOOT_KEY="/etc/pki/akmods/certs/akmods-ublue.der"
 
 if [[ ! -d "/sys/firmware/efi" ]]; then
     echo "EFI mode not detected. Skipping key enrollment."
diff --git a/iso_files/smoke-tests.sh b/iso_files/smoke-tests.sh
new file mode 100755
index 0000000..fa56c10
--- /dev/null
+++ b/iso_files/smoke-tests.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -eoux pipefail
+
+# secureboot key that is enrolled on first-boot, we already have a test for
+# kernel on the image build
+stat /etc/pki/akmods/certs/akmods-ublue.der