diff --git a/Cargo.lock b/Cargo.lock
index 92d225b..51ffd62 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -104,7 +104,7 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "bakery"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "chrono",
@@ -149,7 +149,7 @@ dependencies = [
 
 [[package]]
 name = "bread-onnx"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "bread-utils",
@@ -175,7 +175,7 @@ dependencies = [
 
 [[package]]
 name = "bread-theme"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "dirs",
  "gtk4",
@@ -185,7 +185,7 @@ dependencies = [
 
 [[package]]
 name = "bread-utils"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "bread-shared",
  "dirs",
diff --git a/Cargo.toml b/Cargo.toml
index 6675555..23f96e4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["bakery", "bread-theme", "bread-utils", "bread-onnx"]
 resolver = "2"
 
 [workspace.package]
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 license = "MIT"
 authors = ["Breadway <plasticbread849@gmail.com>"]
diff --git a/bakery/src/manifest.rs b/bakery/src/manifest.rs
index 2a8e7ac..35a9bbc 100644
--- a/bakery/src/manifest.rs
+++ b/bakery/src/manifest.rs
@@ -17,7 +17,7 @@ const CACHE_MAX_AGE: Duration = Duration::from_secs(24 * 3600);
 /// bytes are trusted or parsed. This is the single control point: the
 /// per-artifact `sha256` fields and `post_install` hook strings all live
 /// inside `index.json` itself, so a valid signature transitively covers them.
-const PUBKEY: &str = "RWRh2Zr5SUinvVFCtD7S7HwGjfrye6j31Xq2mYXRdkGFDWe3yHF7W11K";
+const PUBKEY: &str = "RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8";
 
 /// Verify `bytes` against `sig_text` (the contents of an `index.json.minisig`
 /// file) using the pinned [`PUBKEY`]. Returns an error on any failure —
diff --git a/scripts/get.sh b/scripts/get.sh
index a2df2eb..6a1707e 100755
--- a/scripts/get.sh
+++ b/scripts/get.sh
@@ -9,7 +9,7 @@ set -eu
 # index.json and the bakery binary itself). Do not source this from the
 # network — it must be baked into this script so a compromised dl server
 # can't swap it out along with a malicious binary.
-BAKERY_MINISIGN_PUBKEY="RWRh2Zr5SUinvVFCtD7S7HwGjfrye6j31Xq2mYXRdkGFDWe3yHF7W11K"
+BAKERY_MINISIGN_PUBKEY="RWTBR8w/IJ+jaylOv80b52DzekKbSR2CvOVGvzB0ipGBaMhJPAOiEWq8"
 
 BAKERY_VERSION="${BAKERY_VERSION:-latest}"
 BIN_DIR="${BAKERY_BIN_DIR:-$HOME/.local/bin}"