diff --git a/board/czechlight/clearfog/overlay/etc/rauc/system.conf b/board/czechlight/clearfog/overlay/etc/rauc/system.conf
index 8adc7f9..8fc94d4 100644
--- a/board/czechlight/clearfog/overlay/etc/rauc/system.conf
+++ b/board/czechlight/clearfog/overlay/etc/rauc/system.conf
@@ -2,6 +2,9 @@
 compatible=czechlight-clearfog
 bootloader=uboot
 
+[keyring]
+path=/etc/rauc/keyring.pem
+
 [slot.rootfs.0]
 device=/dev/mmcblk0p1
 type=ext4
diff --git a/board/czechlight/common/install-rauc-cert.sh b/board/czechlight/common/install-rauc-cert.sh
new file mode 100755
index 0000000..bff359b
--- /dev/null
+++ b/board/czechlight/common/install-rauc-cert.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+install -m 0644 -D ${BR2_EXTERNAL_CZECHLIGHT_PATH}/crypto/rauc-cert.pem $TARGET_DIR/etc/rauc/keyring.pem
diff --git a/configs/czechlight_clearfog_defconfig b/configs/czechlight_clearfog_defconfig
index 7bebbd4..5fdfe43 100644
--- a/configs/czechlight_clearfog_defconfig
+++ b/configs/czechlight_clearfog_defconfig
@@ -12,7 +12,7 @@
 BR2_TARGET_GENERIC_GETTY_BAUDRATE_115200=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_CZECHLIGHT_PATH)/board/czechlight/common/overlay/ $(BR2_EXTERNAL_CZECHLIGHT_PATH)/board/czechlight/clearfog/overlay/"
-BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_CZECHLIGHT_PATH)/board/czechlight/common/mk-empty-cfg-fs.sh"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_CZECHLIGHT_PATH)/board/czechlight/common/mk-empty-cfg-fs.sh $(BR2_EXTERNAL_CZECHLIGHT_PATH)/board/czechlight/common/install-rauc-cert.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="support/scripts/genimage.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_CZECHLIGHT_PATH)/board/czechlight/clearfog/genimage.cfg"
 BR2_LINUX_KERNEL=y