diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index fa71f2bffd2..8dab68a5177 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: systemd/mkosi@32105855f386c980069d134d1b0f8fea4db2129e
+      - uses: systemd/mkosi@7e4ec15aee6b98300b2ee14265bc647a716a9f8a
 
       # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
       # immediately, we remove the files in the background. However, we first move them to a different location
diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index fff7067ae89..033567379c1 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -120,7 +120,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: systemd/mkosi@32105855f386c980069d134d1b0f8fea4db2129e
+      - uses: systemd/mkosi@7e4ec15aee6b98300b2ee14265bc647a716a9f8a
 
       # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
       # immediately, we remove the files in the background. However, we first move them to a different location
diff --git a/.gitignore b/.gitignore
index a6e1ba566f8..73ab928bb68 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,8 +24,8 @@ __pycache__/
 /ID
 /build*
 /install-tree
-/mkosi.key
-/mkosi.crt
+/mkosi/mkosi.key
+/mkosi/mkosi.crt
 /mkosi.tools/
 /mkosi.tools.manifest
 /mkosi/mkosi.local.conf
diff --git a/mkosi/mkosi.conf b/mkosi/mkosi.conf
index efd3d715783..cd52047cff1 100644
--- a/mkosi/mkosi.conf
+++ b/mkosi/mkosi.conf
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 [Config]
-MinimumVersion=commit:32105855f386c980069d134d1b0f8fea4db2129e
+MinimumVersion=commit:7e4ec15aee6b98300b2ee14265bc647a716a9f8a
 Dependencies=
         exitrd
         initrd
@@ -39,15 +39,11 @@ WithTests=no
 
 [Validation]
 SignExpectedPcr=yes
-SignExpectedPcrKey=../mkosi.key
-SignExpectedPcrCertificate=../mkosi.crt
-VerityKey=../mkosi.key
-VerityCertificate=../mkosi.crt
 
 [Content]
 ExtraTrees=
         mkosi.extra.common
-        ../mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
+        mkosi.crt:/usr/lib/verity.d/mkosi.crt # sysext verification key
         %O/minimal-0.root-%a.raw:/usr/share/minimal_0.raw
         %O/minimal-0.root-%a-verity.raw:/usr/share/minimal_0.verity
         %O/minimal-0.root-%a-verity-sig.raw:/usr/share/minimal_0.verity.sig
@@ -138,8 +134,6 @@ Packages=
         zstd
 
 [Runtime]
-SshKey=../mkosi.key
-SshCertificate=../mkosi.crt
 Credentials=
         journal.storage=persistent
         tty.serial.hvc0.agetty.autologin=root