diff --git a/README.md b/README.md
index d7a695b..4a74b89 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,8 @@ The below makes an XFCE live image.
 % mock -r rocky+epel-9-x86_64 --install kiwi-cli \
   dracut-kiwi-live \
   kiwi-systemdeps-{bootloaders,containers,core,disk-images,filesystems,image-validation,iso-media} \
-  distribution-gpg-keys
+  distribution-gpg-keys \
+  epel-release
 
 % sudo setenforce 0
 % mock -r rocky+epel-9-x86_64 --shell --enable-network --isolation=simple
diff --git a/repositories/core-outside.xml b/repositories/core-outside.xml
new file mode 100644
index 0000000..ad3dfe8
--- /dev/null
+++ b/repositories/core-outside.xml
@@ -0,0 +1,22 @@
+<image>
+  <repository type="rpm-md" alias="baseos" priority="1">
+    <source path="https://download.rockylinux.org/stg/rocky/$releasever/BaseOS/$basearch/os">
+      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+    </source>
+  </repository>
+  <repository type="rpm-md" alias="appstream" priority="1">
+    <source path="https://download.rockylinux.org/stg/rocky/$releasever/AppStream/$basearch/os">
+      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+    </source>
+  </repository>
+  <repository type="rpm-md" alias="crb" priority="1">
+    <source path="https://download.rockylinux.org/stg/rocky/$releasever/CRB/$basearch/os">
+      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+    </source>
+  </repository>
+  <repository type="rpm-md" alias="extras" priority="1">
+    <source path="https://download.rockylinux.org/stg/rocky/$releasever/extras/$basearch/os">
+      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+    </source>
+  </repository>
+</image>
diff --git a/repositories/core.xml b/repositories/core.xml
index ad3dfe8..a252cdb 100644
--- a/repositories/core.xml
+++ b/repositories/core.xml
@@ -1,22 +1,22 @@
 <image>
   <repository type="rpm-md" alias="baseos" priority="1">
     <source path="https://download.rockylinux.org/stg/rocky/$releasever/BaseOS/$basearch/os">
-      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+      <signing key="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-$releasever"/>
     </source>
   </repository>
   <repository type="rpm-md" alias="appstream" priority="1">
     <source path="https://download.rockylinux.org/stg/rocky/$releasever/AppStream/$basearch/os">
-      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+      <signing key="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-$releasever"/>
     </source>
   </repository>
   <repository type="rpm-md" alias="crb" priority="1">
     <source path="https://download.rockylinux.org/stg/rocky/$releasever/CRB/$basearch/os">
-      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+      <signing key="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-$releasever"/>
     </source>
   </repository>
   <repository type="rpm-md" alias="extras" priority="1">
     <source path="https://download.rockylinux.org/stg/rocky/$releasever/extras/$basearch/os">
-      <signing key="file:///usr/share/distribution-gpg-keys/rocky/RPM-GPG-KEY-Rocky-$releasever"/>
+      <signing key="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-$releasever"/>
     </source>
   </repository>
 </image>
diff --git a/repositories/epel-outside.xml b/repositories/epel-outside.xml
new file mode 100644
index 0000000..f53c9f4
--- /dev/null
+++ b/repositories/epel-outside.xml
@@ -0,0 +1,7 @@
+<image>
+  <repository type="rpm-md" alias="epel" priority="2">
+    <source path="https://dl.fedoraproject.org/pub/epel/$releasever/Everything/x86_64/">
+      <signing key="file:///usr/share/distribution-gpg-keys/epel/RPM-GPG-KEY-EPEL-$releasever"/>
+    </source>
+  </repository>
+</image>
diff --git a/repositories/epel.xml b/repositories/epel.xml
index f53c9f4..bb1e1de 100644
--- a/repositories/epel.xml
+++ b/repositories/epel.xml
@@ -1,7 +1,7 @@
 <image>
   <repository type="rpm-md" alias="epel" priority="2">
     <source path="https://dl.fedoraproject.org/pub/epel/$releasever/Everything/x86_64/">
-      <signing key="file:///usr/share/distribution-gpg-keys/epel/RPM-GPG-KEY-EPEL-$releasever"/>
+      <signing key="file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-$releasever"/>
     </source>
   </repository>
 </image>