diff --git a/frontend/azlinux/handle_container.go b/frontend/azlinux/handle_container.go
index 6b3ddb091..aeedc96f1 100644
--- a/frontend/azlinux/handle_container.go
+++ b/frontend/azlinux/handle_container.go
@@ -56,7 +56,7 @@ func specToContainerLLB(w worker, spec *dalec.Spec, targetKey string, rpmDir llb
 	}
 
 	installTimeRepos := spec.GetInstallRepos(targetKey)
-	importRepos, err := repoMountInstallOpts(builderImg, installTimeRepos, sOpt, opts...)
+	importRepos, err := repoMountInstallOpts(w, builderImg, installTimeRepos, sOpt, opts...)
 	if err != nil {
 		return llb.Scratch(), err
 	}
diff --git a/frontend/azlinux/handle_rpm.go b/frontend/azlinux/handle_rpm.go
index 1a1ae1348..26d41b615 100644
--- a/frontend/azlinux/handle_rpm.go
+++ b/frontend/azlinux/handle_rpm.go
@@ -102,7 +102,15 @@ var azLinuxRepoConfig = dalec.RepoPlatformConfig{
 	GPGKeyRoot: "/etc/pki/rpm-gpg",
 }
 
-func repoMountInstallOpts(worker llb.State, repos []dalec.PackageRepositoryConfig, sOpt dalec.SourceOpts, opts ...llb.ConstraintsOpt) ([]installOpt, error) {
+func repoMountInstallOpts(w worker, base llb.State, repos []dalec.PackageRepositoryConfig, sOpt dalec.SourceOpts, opts ...llb.ConstraintsOpt) ([]installOpt, error) {
+	worker := base.Run(
+		w.Install(
+			[]string{"gnupg2"},
+			installWithConstraints(opts),
+		),
+		dalec.WithConstraints(opts...),
+	).Root()
+
 	withRepos, err := dalec.WithRepoConfigs(repos, &azLinuxRepoConfig, sOpt, opts...)
 	if err != nil {
 		return nil, err
@@ -129,7 +137,7 @@ func withTestDeps(w worker, spec *dalec.Spec, sOpt dalec.SourceOpts, targetKey s
 	}
 
 	testRepos := spec.GetTestRepos(targetKey)
-	importRepos, err := repoMountInstallOpts(base, testRepos, sOpt, opts...)
+	importRepos, err := repoMountInstallOpts(w, base, testRepos, sOpt, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -207,7 +215,7 @@ func installBuildDeps(ctx context.Context, w worker, client gwclient.Client, spe
 		return nil, err
 	}
 
-	importRepos, err := repoMountInstallOpts(base, repos, sOpt, opts...)
+	importRepos, err := repoMountInstallOpts(w, base, repos, sOpt, opts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/frontend/jammy/handle_deb.go b/frontend/jammy/handle_deb.go
index 279908334..90e066fa7 100644
--- a/frontend/jammy/handle_deb.go
+++ b/frontend/jammy/handle_deb.go
@@ -126,6 +126,7 @@ var jammyRepoPlatformCfg = dalec.RepoPlatformConfig{
 }
 
 func customRepoMounts(worker llb.State, repos []dalec.PackageRepositoryConfig, sOpt dalec.SourceOpts, opts ...llb.ConstraintsOpt) (llb.RunOption, error) {
+	worker = worker.Run(installPackages([]string{"gnupg2"}, opts...), dalec.WithConstraints(opts...)).Root() // make sure we have gpg installed
 	withRepos, err := dalec.WithRepoConfigs(repos, &jammyRepoPlatformCfg, sOpt, opts...)
 	if err != nil {
 		return nil, err
diff --git a/frontend/windows/handle_zip.go b/frontend/windows/handle_zip.go
index 9048a09ba..67c46221c 100644
--- a/frontend/windows/handle_zip.go
+++ b/frontend/windows/handle_zip.go
@@ -316,6 +316,12 @@ var jammyRepoPlatformCfg = dalec.RepoPlatformConfig{
 }
 
 func customRepoMounts(worker llb.State, repos []dalec.PackageRepositoryConfig, sOpt dalec.SourceOpts, opts ...llb.ConstraintsOpt) (llb.RunOption, error) {
+	worker = worker.Run(
+		dalec.ShArgs("apt update && apt install -y gnupg2"),
+		dalec.WithMountedAptCache(aptCachePrefix),
+		dalec.WithConstraints(opts...),
+	).Root() // make sure we have gpg installed
+
 	withRepos, err := dalec.WithRepoConfigs(repos, &jammyRepoPlatformCfg, sOpt, opts...)
 	if err != nil {
 		return nil, err