diff --git a/config.yaml b/config.yaml
index 7519473..1198886 100644
--- a/config.yaml
+++ b/config.yaml
@@ -384,6 +384,24 @@ actions:
               Source480: %{name}-x86_64_v2-rt-rhel.config
               Source481: %{name}-x86_64_v2-rt-debug-rhel.config
         count: 1
+
+      # Upstream (RHEL-169468) derives the pesign cert name at build time from
+      # the cert file, expecting a distro-named cert next to the generic
+      # secureboot-*.cer ones (CentOS ships centossecureboot801.cer).
+      # almalinux-sb-certs ships only the generic names, so the discovery falls
+      # back to "secureboot-kernel-<arch>", which the sign node does not know
+      # and rpm-sign fails. Pin the AlmaLinux key name explicitly.
+      # Do not drop these two rules: without them SecureBoot signing breaks on
+      # x86_64, aarch64, ppc64le and s390x.
+      - target: "spec"
+        find: "    pesign_name_0=$(get_pesign_name %{secureboot_key_0})"
+        replace: "    pesign_name_0=almalinuxsecureboot0"
+        count: 1
+      - target: "spec"
+        find: "        pesign_name_uki_0=$(get_pesign_name %{secureboot_key_uki_0})"
+        replace: "        pesign_name_uki_0=almalinuxsecureboot0"
+        count: 1
+
   - run_script:
       - script: "create_symlinks.sh"