diff --git a/.gitignore b/.gitignore
index 2310ee0..2599e2e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,8 @@ dist/
 .vite/
 coverage/
 *.local
+
+# Signing keys. The documented `tauri signer generate -w` writes into the working directory, and
+# this repository is public — one `git add -A` is all it would take.
+*.key
+*.key.pub
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 249a313..134e771 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -47,7 +47,7 @@
 	},
 	"plugins": {
 		"updater": {
-			"pubkey": "",
+			"pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEY3NzE5Qjg2RjZCQ0U5NDMKUldSRDZiejJocHR4OTNSSkVXWWdheWNvQ1pjcG9HUlNTSGkvTXBZTFNuWThydjM0ZkpkZUxuZUgK",
 			"endpoints": [
 				"https://github.com/thorstenalpers/OpenEventViewer/releases/latest/download/latest.json"
 			]