diff --git a/templates/scripts/includes/deployment.sh b/templates/scripts/includes/deployment.sh
index d43e98e..f8fbf45 100755
--- a/templates/scripts/includes/deployment.sh
+++ b/templates/scripts/includes/deployment.sh
@@ -2488,7 +2488,17 @@ EOF
   if [[ ! -f "${puppet_gpg}" ]]; then
     die "Can't find ${puppet_gpg} file"
   fi
-  cp "${puppet_gpg}" "${TARGET}/etc/apt/trusted.gpg.d/"
+
+  if echo "7b4ed31e1028f921b5c965df0a42e508  /root/puppet.gpg" | md5sum -c ; then
+    echo "Identified outdated puppetlabs key, fetching key (see MT#60283)"
+    wget https://deb.sipwise.com/files/puppetlabs-pubkey-2025.gpg -O "${TARGET}/etc/apt/trusted.gpg.d/puppet.asc"
+  elif echo "d6368c2df370ff2093831daad16d9eeb  /root/puppet.gpg" | md5sum -c ; then
+    echo "Puppetlabs key seems to be in 'Public-Key (old)' format, installing as puppet.asc"
+    cp "${puppet_gpg}" "${TARGET}/etc/apt/trusted.gpg.d/puppet.asc"
+  else
+    echo "Installing Puppetlabs key as puppet.gpg"
+    cp "${puppet_gpg}" "${TARGET}/etc/apt/trusted.gpg.d/"
+  fi
 
   grml-chroot "${TARGET}" apt-get update
   grml-chroot "${TARGET}" apt-get -y install puppet-agent openssh-server lsb-release ntpsec-ntpdate
diff --git a/wrapper.sh b/wrapper.sh
index df471d6..dc70441 100755
--- a/wrapper.sh
+++ b/wrapper.sh
@@ -69,7 +69,7 @@ echo "${repo_addr}" > "${outside_fai_config}files/SIPWISE/${source_list_path}"
 
 # get the puppet public key, so no need to download it in deployment.sh
 puppet_key='puppet.gpg'
-wget -O "${outside_fai_config}/files/PUPPETLABS/root/${puppet_key}" http://apt.puppetlabs.com/DEB-GPG-KEY-puppetlabs
+wget -O "${outside_fai_config}/files/PUPPETLABS/root/${puppet_key}" https://deb.sipwise.com/files/puppetlabs-pubkey-2025.gpg
 
 build_command=''
 build_command+=" cp -rv /grml/config/ /code/grml-live/"