diff --git a/build-container-d4ade9c3-5a2e9669.pem b/build-container-d4ade9c3-5a2e9669.pem
new file mode 100644
index 0000000..137804c
--- /dev/null
+++ b/build-container-d4ade9c3-5a2e9669.pem
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvM/dHoi6nSy7hbKHLYUr
+Xy6Bv35JbdoIzny5vSFiRXApr0KS56U8PugdGmh+vd7H8YNlx2YOJxzv02Blsrcm
+WDZcXjE3Xpsi/IHFfRZLOdwwR+u8MNFxwRUVzxyIzKGtbREVVfXPfb2Xc6FL5/tE
+vQtUKuR6XdzSaav2RnV5IybCB09s0Np0AUbdi5EfSe4INuqgY+VFYLjvM5onbAQL
+N3bFLS4Quk66Dhv93Zi6NwopwL1F07UPC5uadkyePStP3PA0OAOemj9vZADOWx5a
+dsGCKISs8iphNC5mDVoLy8Ry49Ms3eQXRjVQOMco3YNf8AhsIdxDNBVN8VTDKVkE
+DwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/suse-build-key.changes b/suse-build-key.changes
index f6e70f7..f1fcba5 100644
--- a/suse-build-key.changes
+++ b/suse-build-key.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Mon Oct 16 08:55:24 UTC 2023 - Marcus Meissner <meissner@suse.com>
+
+- build-container-d4ade9c3-5a2e9669.pem: added missing current
+  PEM container key.
+- install the PEM files to the container dir, not the .asc files
+  (bsc#1216203)
+
 -------------------------------------------------------------------
 Tue Sep 12 10:08:56 UTC 2023 - Marcus Meissner <meissner@suse.com>
 
diff --git a/suse-build-key.spec b/suse-build-key.spec
index 89bf8b8..63c2cc4 100644
--- a/suse-build-key.spec
+++ b/suse-build-key.spec
@@ -50,6 +50,8 @@ Source2:        gpg-pubkey-307e3d54-5aaa90a5.asc
 #     Key fingerprint = 0EE9 CA43 0050 9E29 17A0  54ED 8EFE 1BC4 D4AD E9C3
 # container key used by Container TUF style signing.
 Source3:        build-container-d4ade9c3-5a2e9669.asc
+# same, in PEM format
+Source10:       build-container-d4ade9c3-5a2e9669.pem
 
 # New ALP Keys
 #pub   rsa4096/0xFEC28EAF09D9EA69 2023-05-10 [SC] [expires: 2027-05-09]
@@ -126,9 +128,10 @@ install -m 755 %{SOURCE100} $RPM_BUILD_ROOT/usr/lib/rpm/gnupg
 install -d -m 755 $RPM_BUILD_ROOT%{containerkeydir}/
 install -c -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{containerkeydir}/suse-container-key.asc
 install -c -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{containerkeydir}/suse-container-key-4096.asc
+
 install -d -m 755 $RPM_BUILD_ROOT%{pemcontainerkeydir}/
-install -c -m 644 %{SOURCE3} $RPM_BUILD_ROOT%{pemcontainerkeydir}/suse-container-key.pem
-install -c -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{pemcontainerkeydir}/suse-container-key-4096.pem
+install -c -m 644 %{SOURCE10} $RPM_BUILD_ROOT%{pemcontainerkeydir}/suse-container-key.pem
+install -c -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{pemcontainerkeydir}/suse-container-key-4096.pem
 
 %files
 %defattr(644,root,root)