diff --git a/cn/lib/mirror.sh b/cn/lib/mirror.sh
index 60bb724b..4a95ef79 100644
--- a/cn/lib/mirror.sh
+++ b/cn/lib/mirror.sh
@@ -14,6 +14,9 @@ cn_mirror_omarchy_repo_ok() {
 
 cn_mirror_omarchy_repo_fix() {
   local conf="${OMARCHYCN_PACMAN_CONF:-/etc/pacman.conf}"
+  # [omarchy] requires signed packages; the mirror re-signs with the registry key
+  sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc" > /dev/null
+  sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4 > /dev/null
   cn_mirror_omarchy_repo_ok && return 0
   sudo sed -i "s|^Server = https://pkgs.omarchy.org/stable/|Server = $CN_OMARCHY_MIRROR\nServer = https://pkgs.omarchy.org/stable/|" "$conf"
 }
diff --git a/cn/migrations/1787861071.sh b/cn/migrations/1787861071.sh
index 33dd3a32..b4d6d355 100644
--- a/cn/migrations/1787861071.sh
+++ b/cn/migrations/1787861071.sh
@@ -1,8 +1,5 @@
 echo "Trust the OmarchyCN registry key and put the [omarchy] mirror first"
 
-sudo pacman-key --add "$OMARCHY_PATH/cn/keys/omarchycn-registry.asc"
-sudo pacman-key --lsign-key 74DCF57ACD812B24D959F146BD386048867B33B4
-
 # Only the stable channel is mirrored; edge/rc systems keep upstream directly
 source "$OMARCHY_PATH/cn/lib/mirror.sh"
 cn_mirror_omarchy_repo_fix