diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 54a8481a5e8..c353423c582 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -54,9 +54,8 @@ jobs:
       fail-fast: false
       matrix:
         include:
-# Temporarily disabled due to keyring packaging issues
-#          - distro: arch
-#            release: rolling
+          - distro: arch
+            release: rolling
           - distro: debian
             release: testing
           - distro: ubuntu
@@ -77,33 +76,44 @@ jobs:
 
     steps:
     - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
-    - uses: systemd/mkosi@0af3f8a35c3be0e54b20234be7ab478d25bcc740
+    - uses: systemd/mkosi@cb5974d013f7c4c2a45f67c9ae990767e32e9034
 
     - name: Configure
       run: |
+        # We configure ExtraSearchPaths=build/ so make sure build/ exists.
+        mkdir build/
+
         tee mkosi.conf <<- EOF
         [Distribution]
         Distribution=${{ matrix.distro }}
         Release=${{ matrix.release }}
+        EOF
 
+        tee mkosi.conf.d/99-ci.conf <<- EOF
         [Content]
         Environment=CI_BUILD=1
                     SLOW_TESTS=true
 
-        [Output]
+        [Host]
         KernelCommandLineExtra=systemd.unit=mkosi-check-and-shutdown.service
                                systemd.journald.max_level_console=debug
                                # udev's debug log output is very verbose, so up it to info in CI.
                                udev.log_level=info
                                # Root device can take a long time to appear, so let's bump the timeout.
                                systemd.default_device_timeout_sec=180
-
-        [Host]
-        ExtraSearchPaths=!*
         QemuVsock=yes
         Ephemeral=yes
         EOF
 
+        # TODO: Remove once archlinux-keyring is updated in ppa:michel-slm/kernel-utils.
+        tee mkosi.conf.d/11-arch-keyring.conf <<- EOF
+        [Match]
+        Distribution=arch
+
+        [Distribution]
+        RepositoryKeyCheck=no
+        EOF
+
         # For erofs, we have to install linux-modules-extra-azure, but that doesn't match the running kernel
         # version, so we can't load the erofs module. squashfs is a builtin module so we use that instead.
 
diff --git a/mkosi.conf.d/05-qemu-mem.conf b/mkosi.conf.d/05-qemu-mem.conf
index 7dd02925c01..3a6f24a7b0c 100644
--- a/mkosi.conf.d/05-qemu-mem.conf
+++ b/mkosi.conf.d/05-qemu-mem.conf
@@ -8,4 +8,4 @@ Distribution=|arch
 Distribution=|centos
 
 [Host]
-QemuMem=3G
+@QemuMem=3G
diff --git a/mkosi.conf.d/10-centos.conf b/mkosi.conf.d/10-centos.conf
index 6932b8b29cd..ae2706c7917 100644
--- a/mkosi.conf.d/10-centos.conf
+++ b/mkosi.conf.d/10-centos.conf
@@ -4,7 +4,7 @@
 Distribution=centos
 
 [Distribution]
-Release=9
+@Release=9
 Repositories=epel
              epel-next
              hyperscale-packages-main
diff --git a/mkosi.conf.d/10-debian.conf b/mkosi.conf.d/10-debian.conf
index 0eeaf074000..8674e884fad 100644
--- a/mkosi.conf.d/10-debian.conf
+++ b/mkosi.conf.d/10-debian.conf
@@ -4,4 +4,4 @@
 Distribution=debian
 
 [Distribution]
-Release=testing
+@Release=testing
diff --git a/mkosi.conf.d/10-fedora.conf b/mkosi.conf.d/10-fedora.conf
index 4511dcdf879..0196c9f745c 100644
--- a/mkosi.conf.d/10-fedora.conf
+++ b/mkosi.conf.d/10-fedora.conf
@@ -4,4 +4,4 @@
 Distribution=fedora
 
 [Distribution]
-Release=38
+@Release=38
diff --git a/mkosi.conf.d/10-opensuse.conf b/mkosi.conf.d/10-opensuse.conf
index 98a7b4ef5cc..832c0d15fb2 100644
--- a/mkosi.conf.d/10-opensuse.conf
+++ b/mkosi.conf.d/10-opensuse.conf
@@ -4,4 +4,4 @@
 Distribution=opensuse
 
 [Distribution]
-Release=tumbleweed
+@Release=tumbleweed
diff --git a/mkosi.conf.d/10-systemd.conf b/mkosi.conf.d/10-systemd.conf
index adf3316ca53..f25d53d2b76 100644
--- a/mkosi.conf.d/10-systemd.conf
+++ b/mkosi.conf.d/10-systemd.conf
@@ -12,8 +12,8 @@ Environment=ASAN_OPTIONS=verify_asan_link_order=false
             MKOSI_UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
 
 [Host]
-Incremental=yes
-QemuMem=2G
+@Incremental=yes
+@QemuMem=2G
 ExtraSearchPaths=build/
 # Make sure we don't trigger systemd-firstboot prompting for the root password.
 Credentials=passwd.plaintext-password.root=
diff --git a/mkosi.conf.d/10-ubuntu.conf b/mkosi.conf.d/10-ubuntu.conf
index d6ea6d1708d..b0ebbadd489 100644
--- a/mkosi.conf.d/10-ubuntu.conf
+++ b/mkosi.conf.d/10-ubuntu.conf
@@ -4,5 +4,5 @@
 Distribution=ubuntu
 
 [Distribution]
-Release=jammy
+@Release=jammy
 Repositories=universe
diff --git a/mkosi.presets/base/mkosi.conf b/mkosi.presets/base/mkosi.conf
index eb67bfcf628..6c6d0457752 100644
--- a/mkosi.presets/base/mkosi.conf
+++ b/mkosi.presets/base/mkosi.conf
@@ -6,6 +6,8 @@ Format=directory
 [Content]
 Bootable=no
 CleanPackageMetadata=no
+
+Packages=
 Packages=
         kmod
         less
diff --git a/mkosi.presets/initrd/mkosi.conf b/mkosi.presets/initrd/mkosi.conf
index 6099e2e3e16..5d347b71d81 100644
--- a/mkosi.presets/initrd/mkosi.conf
+++ b/mkosi.presets/initrd/mkosi.conf
@@ -14,6 +14,10 @@ Format=cpio
 BaseTrees=../../mkosi.output/base
 ExtraTrees=../../mkosi.output/base-systemd
 MakeInitrd=yes
+Bootable=no
+BuildPackages=
+
+Packages=
 Packages=
         gzip
         systemd
diff --git a/mkosi.presets/system/mkosi.conf b/mkosi.presets/system/mkosi.conf
index 935cea4d3b0..58cd4939427 100644
--- a/mkosi.presets/system/mkosi.conf
+++ b/mkosi.presets/system/mkosi.conf
@@ -44,6 +44,8 @@ Packages=
         xfsprogs
         zsh
 
+BuildPackages=
+
 [Validation]
 SecureBoot=yes
 SignExpectedPcr=yes