diff --git a/apt/tasks/migrate-to-deb822.yml b/apt/tasks/migrate-to-deb822.yml
index 18aa1580..e7339e8b 100644
--- a/apt/tasks/migrate-to-deb822.yml
+++ b/apt/tasks/migrate-to-deb822.yml
@@ -30,3 +30,21 @@
   ignore_errors: yes
   tags:
     - apt
+
+- name: Add signed-by when relevant for bookworm
+  ansible.builtin.lineinfile:
+    dest: /etc/apt/sources.list.d/system.sources
+    line: "Signed-by: /usr/share/keyrings/debian-archive-keyring.gpg"
+    insertafter: "Suites: bookworm bookworm-updates"
+    state: present
+  tags:
+    - apt
+
+- name: Add signed-by when relevant for bookworm-security
+  ansible.builtin.lineinfile:
+    dest: /etc/apt/sources.list.d/security.sources
+    line: "Signed-by: /usr/share/keyrings/debian-archive-keyring.gpg"
+    insertafter: "Suites: bookworm-security"
+    state: present
+  tags:
+    - apt