diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0b5a78c..5d336a9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 
 ### Added
 
+* apt: Explicit "signed-by" directives for official sources
 * apt: Disable NonFreeFirmware warning for VM on Debian 12+
 * bind: Add reload-zone helper
 * docker-host: added var for user namespace setting
diff --git a/apt/templates/bookworm_basics.sources.j2 b/apt/templates/bookworm_basics.sources.j2
index 5a0cd3aa..948c4adf 100644
--- a/apt/templates/bookworm_basics.sources.j2
+++ b/apt/templates/bookworm_basics.sources.j2
@@ -5,3 +5,4 @@ URIs: http://mirror.evolix.org/debian
 Suites: bookworm bookworm-updates
 Components: {{ apt_basics_components | mandatory }} 
 Enabled: yes
+Signed-By: /usr/share/keyrings/debian-archive-bookworm-automatic.gpg
diff --git a/apt/templates/bookworm_security.sources.j2 b/apt/templates/bookworm_security.sources.j2
index 56180957..07f1345b 100644
--- a/apt/templates/bookworm_security.sources.j2
+++ b/apt/templates/bookworm_security.sources.j2
@@ -5,3 +5,4 @@ URIs: https://security.debian.org/debian-security
 Suites: bookworm-security
 Components: {{ apt_basics_components | mandatory }} 
 Enabled: yes
+Signed-By: /usr/share/keyrings/debian-archive-bookworm-security-automatic.gpg
\ No newline at end of file