diff --git a/.github/scripts/strategy-matrix/generate.py b/.github/scripts/strategy-matrix/generate.py
index 83f3c67e7f..fb37fb7691 100755
--- a/.github/scripts/strategy-matrix/generate.py
+++ b/.github/scripts/strategy-matrix/generate.py
@@ -219,7 +219,7 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
     """Generate the packaging matrix from a LinuxFile's package_configs section.
 
-    Packaging uses vanilla distro images (debian:bookworm, ubi9, …) instead of
+    Packaging uses vanilla distro images (debian:bookworm, almalinux:9) instead of
     the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
     is taken from the distro's archive rather than from nixpkgs. Each config
     entry carries its own 'image'.
diff --git a/.github/workflows/build-packaging-images.yml b/.github/workflows/build-packaging-images.yml
index 43b276bdf1..fbabc25ac3 100644
--- a/.github/workflows/build-packaging-images.yml
+++ b/.github/workflows/build-packaging-images.yml
@@ -36,8 +36,9 @@ jobs:
         distro:
           - name: debian
             base_image: debian:bookworm
+          # AlmaLinux rather than UBI9, which does not ship rpm-sign.
           - name: rhel
-            base_image: registry.access.redhat.com/ubi9/ubi:latest
+            base_image: almalinux:9
     uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
diff --git a/package/install-packaging-tools.sh b/package/install-packaging-tools.sh
index 06ab44ac93..2326d8f2ac 100755
--- a/package/install-packaging-tools.sh
+++ b/package/install-packaging-tools.sh
@@ -28,6 +28,7 @@ esac
 #   - debhelper and dpkg-dev build the DEB
 #   - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
 #     supplying the systemd and find-debuginfo macros the spec uses
+#   - rpm-sign signs the built RPM
 #   - git gives build_pkg.sh a real history to read SOURCE_DATE_EPOCH from;
 #     without one the timestamp falls back to the wall clock
 #   - curl uploads the finished packages in publish_pkg.sh
@@ -50,6 +51,7 @@ function install() {
                 curl-minimal \
                 git \
                 rpm-build \
+                rpm-sign \
                 redhat-rpm-config \
                 systemd-rpm-macros
             ;;