diff --git a/scripts/build-flatpak.sh b/scripts/build-flatpak.sh
index 1cb6b12..dde16c0 100755
--- a/scripts/build-flatpak.sh
+++ b/scripts/build-flatpak.sh
@@ -4,8 +4,15 @@ set -euo pipefail
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$root"
 
-flatpak-builder --repo=flatpak_repo --force-clean flatpak_build de.nerdbear.bearwave.json
-flatpak build-update-repo flatpak_repo
+gpg_key_id="${BEARWAVE_FLATPAK_GPG_KEY:-AA1D2F0170800855}"
+
+flatpak-builder \
+  --repo=flatpak_repo \
+  --gpg-sign="${gpg_key_id}" \
+  --force-clean \
+  flatpak_build \
+  de.nerdbear.bearwave.json
+flatpak build-update-repo --gpg-sign="${gpg_key_id}" flatpak_repo
 
 echo "Flatpak repo updated in flatpak_repo/."
 echo "Deploy with: scripts/deploy-flatpak.sh"
diff --git a/scripts/deploy-flatpak.sh b/scripts/deploy-flatpak.sh
index 4c84024..1484866 100755
--- a/scripts/deploy-flatpak.sh
+++ b/scripts/deploy-flatpak.sh
@@ -11,6 +11,11 @@ if [[ ! -d flatpak_repo/objects ]]; then
   exit 1
 fi
 
+if [[ ! -f flatpak_repo/summary.sig || ! -f flatpak_repo/summary.idx.sig ]]; then
+  echo "Missing summary.sig files. Run scripts/build-flatpak.sh with GPG signing first." >&2
+  exit 1
+fi
+
 rsync -avz \
   -e 'ssh -o RemoteCommand=none -o RequestTTY=no' \
   --no-group --no-owner \