diff --git a/Dockerfile b/Dockerfile
index a202fb2..cf71086 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -86,6 +86,10 @@ USER root
 #             anywhere. chromedp finds `chromium`/`chromium-browser` on PATH;
 #             chrome-launcher honours CHROME_PATH. font-noto so text renders
 #             (an empty font set makes layout/contrast audits meaningless).
+# openssh-keygen -> `ssh-keygen`: zegit's SSHSIG oracle test
+#             (TestSSHSIG_ChecksumsVerifyWithSSHKeygen_441) verifies release-checksum
+#             signatures with `ssh-keygen -Y verify` and fails under CI without it,
+#             so the v0.1.56 cut was refused on this runner (zegit#575).
 # postgresql-client -> `psql`, so the lighthouse job can CREATE/DROP its own
 #             database on the runner's ci-postgres (ZEGIT_TESTPG_DSN) instead
 #             of migrating the shared maintenance database from under the
@@ -111,7 +115,18 @@ RUN apk add --no-cache \
       jq \
       chromium \
       font-noto \
-      postgresql-client
+      postgresql-client \
+      openssh-keygen
+
+# ssh-keygen signs and verifies an SSHSIG in namespace "file", the form zegit's
+# test uses, so a build without a working ssh-keygen fails here, not in CI.
+RUN set -eu; d=$(mktemp -d); \
+    ssh-keygen -q -t ed25519 -N '' -f "$d/k"; \
+    echo smoke > "$d/f"; \
+    ssh-keygen -q -Y sign -n file -f "$d/k" "$d/f"; \
+    printf 'smoke %s\n' "$(cat "$d/k.pub")" > "$d/allowed"; \
+    ssh-keygen -Y verify -f "$d/allowed" -I smoke -n file -s "$d/f.sig" < "$d/f"; \
+    rm -rf "$d"
 
 # CVE-2026-111497 (brotli decoder out-of-bounds write, CISA KEV, due 2026-11-10): the
 # forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add` above never