diff --git a/roles/koji_hub/files/koji-sign-spooler b/roles/koji_hub/files/koji-sign-spooler
index 2709d90..13065ff 100644
--- a/roles/koji_hub/files/koji-sign-spooler
+++ b/roles/koji_hub/files/koji-sign-spooler
@@ -213,11 +213,10 @@ def process_queue():
                 env['SIGULDRY_SOCKET'] = '/run/siguldry-client-proxy/siguldry-client-proxy.socket'
                 env['CREDENTIALS_DIRECTORY'] = '/etc/credstore'
 
-                # Sign using rpmsign command with Sequoia backend macro definitions
+                # Sign using rpmsign command with GnuPG backend using PKCS#11 module
                 cmd = [
                     'rpmsign',
-                    '--define', '_openpgp_sign sq',
-                    '--define', f'_openpgp_sign_id {sig_key_id}',
+                    '--define', f'_gpg_name {sig_key_id}',
                     '--addsign', full_rpm_path
                 ]
                 
@@ -235,7 +234,7 @@ def process_queue():
                 else:
                     logger.info(f"Successfully signed RPM {rpm_nvr} on disk. Extracting signature header.")
                     sig_data = koji.rip_rpm_sighdr(full_rpm_path)
-                    kojihub.add_rpm_sig(rpm_id, sig_data, sigkey=sig_key_id)
+                    kojihub.add_rpm_sig(rpm_id, sig_data)
                     logger.info(f"Successfully imported signature for {rpm_nvr} with key {sig_key_id}")
             except Exception as e:
                 logger.error(f"Error signing RPM {rpm_nvr}: {e}")
diff --git a/roles/koji_hub/files/koji-sign-spooler.service b/roles/koji_hub/files/koji-sign-spooler.service
index 31b7498..d0f1e0b 100644
--- a/roles/koji_hub/files/koji-sign-spooler.service
+++ b/roles/koji_hub/files/koji-sign-spooler.service
@@ -7,6 +7,8 @@ Type=simple
 ExecStart=/usr/libexec/koji-sign-spooler
 User=root
 Group=apache
+Environment="SIGULDRY_SOCKET=/run/siguldry-client-proxy/siguldry-client-proxy.socket"
+Environment="CREDENTIALS_DIRECTORY=/etc/credstore"
 Restart=always
 RestartSec=5
 
diff --git a/roles/siguldry/tasks/main.yaml b/roles/siguldry/tasks/main.yaml
index f5f2a04..ff9c07b 100644
--- a/roles/siguldry/tasks/main.yaml
+++ b/roles/siguldry/tasks/main.yaml
@@ -264,3 +264,50 @@
       kojiadmin mxos-signing-key
       --password-file <(echo "{{ gpg_key_passphrase }}")
   when: "'mxos-signing-key' not in siguldry_keys_list.stdout"
+
+- name: Ensure GnuPG directory exists for root user
+  ansible.builtin.file:
+    path: /root/.gnupg
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Deploy GnuPG gpg-agent.conf for root user
+  ansible.builtin.copy:
+    dest: /root/.gnupg/gpg-agent.conf
+    owner: root
+    group: root
+    mode: "0600"
+    content: |
+      scdaemon-program /usr/bin/gnupg-pkcs11-scd
+
+- name: Deploy GnuPG gnupg-pkcs11-scd.conf for root user
+  ansible.builtin.copy:
+    dest: /root/.gnupg/gnupg-pkcs11-scd.conf
+    owner: root
+    group: root
+    mode: "0600"
+    content: |
+      providers siguldry
+      provider-siguldry-library /usr/lib64/pkcs11/libsiguldry_pkcs11.so
+
+- name: Kill running gpg-agent to apply PKCS#11 configuration
+  ansible.builtin.command: gpgconf --kill gpg-agent
+  failed_when: false
+  changed_when: false
+
+- name: Check if Siguldry signing key is imported in root keyring
+  ansible.builtin.command: gpg --list-keys koji@cs10-koji-00.mx-os
+  register: siguldry_gpg_key_check
+  failed_when: false
+  changed_when: false
+
+- name: Import Siguldry signing key into root keyring
+  ansible.builtin.shell:
+    cmd: >
+      SIGULDRY_SOCKET=/run/siguldry-client-proxy/siguldry-client-proxy.socket
+      CREDENTIALS_DIRECTORY=/etc/credstore
+      siguldry-client --credentials-directory /etc/credstore -c /etc/siguldry/client.toml key get mxos-signing-key --certificates
+      | gpg --import
+  when: siguldry_gpg_key_check.rc != 0