diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 87ef36ef..5db0155c 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -40,10 +40,22 @@ jobs:
           sudo apt-get install -y flatpak flatpak-builder
           flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
 
+      - name: Import Flatpak signing key
+        env:
+          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
+        run: |
+          export GNUPGHOME="$RUNNER_TEMP/gnupg"
+          mkdir -m 700 "$GNUPGHOME"
+          echo "$FLATPAK_GPG_PRIVATE_KEY" | gpg --batch --import
+          KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^fpr/ {print $10; exit}')
+          echo "GNUPGHOME=$GNUPGHOME" >> "$GITHUB_ENV"
+          echo "KEY_ID=$KEY_ID" >> "$GITHUB_ENV"
+          echo "GPGKey=$(gpg --export "$KEY_ID" | base64 -w0)" >> public/matcha.flatpakref
+
       - name: Build Flatpak Repo
         run: |
-          flatpak-builder --user --install-deps-from=flathub --repo=public/repo --force-clean build-dir com.floatpane.matcha.yaml
-          flatpak build-update-repo --generate-static-deltas public/repo
+          flatpak-builder --user --install-deps-from=flathub --gpg-sign="$KEY_ID" --gpg-homedir="$GNUPGHOME" --repo=public/repo --force-clean build-dir com.floatpane.matcha.yaml
+          flatpak build-update-repo --gpg-sign="$KEY_ID" --gpg-homedir="$GNUPGHOME" --generate-static-deltas public/repo
 
       - name: Setup Pages
         uses: actions/configure-pages@v6
diff --git a/public/matcha.flatpakref b/public/matcha.flatpakref
index 2c9f1225..d5dce122 100644
--- a/public/matcha.flatpakref
+++ b/public/matcha.flatpakref
@@ -5,3 +5,4 @@ Title=Matcha
 IsRuntime=False
 Url=https://matcha.email/repo/
 SuggestRemoteName=matcha
+RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo