diff --git a/GNUmakefile b/GNUmakefile
index f9b4d1d..f92a5e9 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -32,3 +32,14 @@ bootstrap:
 .PHONY: reset
 reset:
 	ansible-playbook --vault-pass-file=.pass reset.yaml
+
+.PHONY: install-ca
+install-ca:
+	cp certs/koji_ca_cert.crt /etc/pki/ca-trust/source/anchors/koji_ca_cert.crt
+	update-ca-trust
+
+.PHONY: remove-ca
+remove-ca:
+	rm -f /etc/pki/ca-trust/source/anchors/koji_ca_cert.crt
+	update-ca-trust
+
diff --git a/roles/koji_hub/files/koji-sign-spooler b/roles/koji_hub/files/koji-sign-spooler
index f78f9f2..e33e809 100644
--- a/roles/koji_hub/files/koji-sign-spooler
+++ b/roles/koji_hub/files/koji-sign-spooler
@@ -27,6 +27,7 @@ def get_siguldry_key_info():
     """
     env = os.environ.copy()
     env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
+    env['CREDENTIALS_DIRECTORY'] = '/etc/credstore'
     
     # Get key info
     res = subprocess.run(
@@ -199,6 +200,7 @@ def process_queue():
                 env = os.environ.copy()
                 env['PKCS11_MODULE_PATH'] = '/usr/lib64/pkcs11/libsiguldry_pkcs11.so'
                 env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
+                env['CREDENTIALS_DIRECTORY'] = '/etc/credstore'
 
                 # Sign using rpmsign command with Sequoia backend macro definitions
                 cmd = [