diff --git a/.github/workflows/build-publish-signed.yml b/.github/workflows/build-publish-signed.yml
index 7bb8c0e..e210143 100644
--- a/.github/workflows/build-publish-signed.yml
+++ b/.github/workflows/build-publish-signed.yml
@@ -25,10 +25,12 @@ jobs:
         env:
           DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DCT_KEY_PASSPHRASE }}
           DCT_KEY_BASE64: ${{ secrets.DCT_KEY_BASE64 }}
+          DCT_KEY_ID: ${{ secrets.DCT_KEY_ID }}
         run: |
-          echo "$DCT_KEY_BASE64" | base64 -d > delegation.key
-          chmod 600 delegation.key
-          docker trust key load delegation.key --name gha
+          mkdir -p ~/.docker/trust/private
+          echo "$DCT_KEY_BASE64" | base64 -d > "~/.docker/trust/private/${DCT_KEY_ID}.key"
+          chmod 600 "~/.docker/trust/private/${DCT_KEY_ID}.key"
+          docker trust key load "~/.docker/trust/private/${DCT_KEY_ID}.key" --name gha
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
@@ -50,4 +52,6 @@ jobs:
           docker trust inspect --pretty ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
 
       - name: Remove DCT delegation key
-        run: rm delegation.key
+        env:
+          DCT_KEY_ID: ${{ secrets.DCT_KEY_ID }}
+        run: rm "~/.docker/trust/private/${DCT_KEY_ID}.key"