diff --git a/app/src/main/java/app/morphe/manager/domain/bundles/RemotePatchBundle.kt b/app/src/main/java/app/morphe/manager/domain/bundles/RemotePatchBundle.kt
index 28644e40e..2ae392c9f 100644
--- a/app/src/main/java/app/morphe/manager/domain/bundles/RemotePatchBundle.kt
+++ b/app/src/main/java/app/morphe/manager/domain/bundles/RemotePatchBundle.kt
@@ -546,7 +546,9 @@ class APIPatchBundle(
     services: RemoteBundleServices,
     val usePrerelease: Boolean = false,
 ) : RemotePatchBundle(name, uid, displayName, createdAt, updatedAt, installedVersionSignature, error, directory, endpoint, enabled, services) {
+    // Releases declare their key, but the API fallback and older releases do not
     override suspend fun getLatestInfo() = api.getPatchesUpdate(usePrerelease).getOrThrow()
+        .let { it.copy(publicKey = it.publicKey ?: SOURCE_SIGNING_KEY) }
 
     // The endpoint is the API identifier rather than a browsable URL
     override val browsePageUrl: String get() = SOURCE_REPO_URL
diff --git a/app/src/main/java/app/morphe/manager/util/Constants.kt b/app/src/main/java/app/morphe/manager/util/Constants.kt
index feb8735a4..d3b64e137 100644
--- a/app/src/main/java/app/morphe/manager/util/Constants.kt
+++ b/app/src/main/java/app/morphe/manager/util/Constants.kt
@@ -17,6 +17,9 @@ const val tag = "Morphe Manager"
 const val SOURCE_NAME = "Morphe Patches"
 const val MANAGER_REPO_URL = "https://github.com/MorpheApp/morphe-manager"
 const val SOURCE_REPO_URL = "https://github.com/MorpheApp/morphe-patches"
+
+/** Key the releases of [SOURCE_REPO_URL] are signed with, see PatchBundleSignature. */
+const val SOURCE_SIGNING_KEY = "g8Ys9leTu2yeixojeR35HrNkK6eOSLpA6nNIizRutqI="
 const val MORPHE_API_URL = "https://api.morphe.software"
 
 /** Sent on every request to [MORPHE_API_URL]. */