diff --git a/stage0/00-configure-apt/00-run.sh b/stage0/00-configure-apt/00-run.sh
index 1b7e03f..8e47893 100755
--- a/stage0/00-configure-apt/00-run.sh
+++ b/stage0/00-configure-apt/00-run.sh
@@ -1,9 +1,10 @@
 #!/bin/bash -e
 
-install -m 644 files/sources.list "${ROOTFS_DIR}/etc/apt/"
-install -m 644 files/raspi.list "${ROOTFS_DIR}/etc/apt/sources.list.d/"
-sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list"
-sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspi.list"
+true > "${ROOTFS_DIR}/etc/apt/sources.list"
+install -m 644 files/raspbian.sources "${ROOTFS_DIR}/etc/apt/sources.list.d/"
+install -m 644 files/raspi.sources "${ROOTFS_DIR}/etc/apt/sources.list.d/"
+sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspbian.sources"
+sed -i "s/RELEASE/${RELEASE}/g" "${ROOTFS_DIR}/etc/apt/sources.list.d/raspi.sources"
 
 if [ -n "$APT_PROXY" ]; then
 	install -m 644 files/51cache "${ROOTFS_DIR}/etc/apt/apt.conf.d/51cache"
@@ -19,8 +20,7 @@ else
 	rm -f "${ROOTFS_DIR}/etc/apt/sources.list.d/00-temp.list"
 fi
 
-cat files/raspberrypi.gpg.key | gpg --dearmor > "${STAGE_WORK_DIR}/raspberrypi-archive-stable.gpg"
-install -m 644 "${STAGE_WORK_DIR}/raspberrypi-archive-stable.gpg" "${ROOTFS_DIR}/etc/apt/trusted.gpg.d/"
+install -m 644 files/raspberrypi-archive-keyring.pgp "${ROOTFS_DIR}/usr/share/keyrings/"
 on_chroot <<- \EOF
 	ARCH="$(dpkg --print-architecture)"
 	if [ "$ARCH" = "armhf" ]; then
diff --git a/stage0/00-configure-apt/files/raspberrypi-archive-keyring.pgp b/stage0/00-configure-apt/files/raspberrypi-archive-keyring.pgp
new file mode 100644
index 0000000..e0ada06
Binary files /dev/null and b/stage0/00-configure-apt/files/raspberrypi-archive-keyring.pgp differ
diff --git a/stage0/00-configure-apt/files/raspberrypi.gpg.key b/stage0/00-configure-apt/files/raspberrypi.gpg.key
deleted file mode 100644
index 60b5f65..0000000
--- a/stage0/00-configure-apt/files/raspberrypi.gpg.key
+++ /dev/null
@@ -1,30 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.12 (GNU/Linux)
-
-mQENBE/d7o8BCACrwqQacGJfn3tnMzGui6mv2lLxYbsOuy/+U4rqMmGEuo3h9m92
-30E2EtypsoWczkBretzLUCFv+VUOxaA6sV9+puTqYGhhQZFuKUWcG7orf7QbZRuu
-TxsEUepW5lg7MExmAu1JJzqM0kMQX8fVyWVDkjchZ/is4q3BPOUCJbUJOsE+kK/6
-8kW6nWdhwSAjfDh06bA5wvoXNjYoDdnSZyVdcYCPEJXEg5jfF/+nmiFKMZBraHwn
-eQsepr7rBXxNcEvDlSOPal11fg90KXpy7Umre1UcAZYJdQeWcHu7X5uoJx/MG5J8
-ic6CwYmDaShIFa92f8qmFcna05+lppk76fsnABEBAAG0IFJhc3BiZXJyeSBQaSBB
-cmNoaXZlIFNpZ25pbmcgS2V5iQE4BBMBAgAiBQJP3e6PAhsDBgsJCAcDAgYVCAIJ
-CgsEFgIDAQIeAQIXgAAKCRCCsSmSf6MwPk6vB/9pePB3IukU9WC9Bammh3mpQTvL
-OifbkzHkmAYxzjfK6D2I8pT0xMxy949+ThzJ7uL60p6T/32ED9DR3LHIMXZvKtuc
-mQnSiNDX03E2p7lIP/htoxW2hDP2n8cdlNdt0M9IjaWBppsbO7IrDppG2B1aRLni
-uD7v8bHRL2mKTtIDLX42Enl8aLAkJYgNWpZyPkDyOqamjijarIWjGEPCkaURF7g4
-d44HvYhpbLMOrz1m6N5Bzoa5+nq3lmifeiWKxioFXU+Hy5bhtAM6ljVb59hbD2ra
-X4+3LXC9oox2flmQnyqwoyfZqVgSQa0B41qEQo8t1bz6Q1Ti7fbMLThmbRHiuQEN
-BE/d7o8BCADNlVtBZU63fm79SjHh5AEKFs0C3kwa0mOhp9oas/haDggmhiXdzeD3
-49JWz9ZTx+vlTq0s+I+nIR1a+q+GL+hxYt4HhxoA6vlDMegVfvZKzqTX9Nr2VqQa
-S4Kz3W5ULv81tw3WowK6i0L7pqDmvDqgm73mMbbxfHD0SyTt8+fk7qX6Ag2pZ4a9
-ZdJGxvASkh0McGpbYJhk1WYD+eh4fqH3IaeJi6xtNoRdc5YXuzILnp+KaJyPE5CR
-qUY5JibOD3qR7zDjP0ueP93jLqmoKltCdN5+yYEExtSwz5lXniiYOJp8LWFCgv5h
-m8aYXkcJS1xVV9Ltno23YvX5edw9QY4hABEBAAGJAR8EGAECAAkFAk/d7o8CGwwA
-CgkQgrEpkn+jMD5Figf/dIC1qtDMTbu5IsI5uZPX63xydaExQNYf98cq5H2fWF6O
-yVR7ERzA2w33hI0yZQrqO6pU9SRnHRxCFvGv6y+mXXXMRcmjZG7GiD6tQWeN/3wb
-EbAn5cg6CJ/Lk/BI4iRRfBX07LbYULCohlGkwBOkRo10T+Ld4vCCnBftCh5x2OtZ
-TOWRULxP36y2PLGVNF+q9pho98qx+RIxvpofQM/842ZycjPJvzgVQsW4LT91KYAE
-4TVf6JjwUM6HZDoiNcX6d7zOhNfQihXTsniZZ6rky287htsWVDNkqOi5T3oTxWUo
-m++/7s3K3L0zWopdhMVcgg6Nt9gcjzqN1c0gy55L/g==
-=mNSj
------END PGP PUBLIC KEY BLOCK-----
diff --git a/stage0/00-configure-apt/files/raspbian.sources b/stage0/00-configure-apt/files/raspbian.sources
new file mode 100644
index 0000000..0f2e26f
--- /dev/null
+++ b/stage0/00-configure-apt/files/raspbian.sources
@@ -0,0 +1,6 @@
+Types: deb
+URIs: http://raspbian.raspberrypi.com/raspbian/
+Arch: armhf
+Suites: RELEASE
+Components: main contrib non-free rpi
+Signed-By: /usr/share/keyrings/raspbian-archive-keyring.gpg
diff --git a/stage0/00-configure-apt/files/raspi.list b/stage0/00-configure-apt/files/raspi.list
deleted file mode 100644
index 5f889b1..0000000
--- a/stage0/00-configure-apt/files/raspi.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb http://archive.raspberrypi.com/debian/ RELEASE main
-# Uncomment line below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://archive.raspberrypi.com/debian/ RELEASE main
diff --git a/stage0/00-configure-apt/files/raspi.sources b/stage0/00-configure-apt/files/raspi.sources
new file mode 100644
index 0000000..1ec8b97
--- /dev/null
+++ b/stage0/00-configure-apt/files/raspi.sources
@@ -0,0 +1,5 @@
+Types: deb
+URIs: http://archive.raspberrypi.com/debian/
+Suites: RELEASE
+Components: main
+Signed-By: /usr/share/keyrings/raspberrypi-archive-keyring.pgp
diff --git a/stage0/00-configure-apt/files/sources.list b/stage0/00-configure-apt/files/sources.list
deleted file mode 100644
index 3ef0699..0000000
--- a/stage0/00-configure-apt/files/sources.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb [ arch=armhf ] http://raspbian.raspberrypi.com/raspbian/ RELEASE main contrib non-free rpi
-# Uncomment line below then 'apt-get update' to enable 'apt-get source'
-#deb-src http://raspbian.raspberrypi.com/raspbian/ RELEASE main contrib non-free rpi