diff --git a/docs/kernel-notes.md b/docs/kernel-notes.md
index 955b997..fae5df7 100644
--- a/docs/kernel-notes.md
+++ b/docs/kernel-notes.md
@@ -182,6 +182,13 @@ only its own latest kernel, so a trixie-era version against a `bookworm` base
 fails with `Version '…' was not found`. Find the Pi's suite with
 `. /etc/os-release; echo "$VERSION_CODENAME"` (or `lsb_release -cs`).
 
+**trixie SHA1 caveat.** On trixie, apt verifies signatures with Sequoia (`sqv`),
+whose crypto policy rejects SHA1 since 2026-02-01. The raspberrypi archive key's
+binding self-signature is SHA1, so trixie's apt rejects the repo as *"not
+signed"* (`Policy rejected … SHA1 is not considered secure …`). The Dockerfile
+works around this by marking the raspberrypi repo `trusted=yes` **only when
+`DEBIAN_SUITE=trixie`**; bookworm (gpgv) keeps full signature verification.
+
 **Find the exact values for *your* Pi** — run this on the Pi (e.g. over SSH); it
 prints the two lines ready to copy into the `build-in-docker.sh` invocation:
 
diff --git a/kernel/Dockerfile b/kernel/Dockerfile
index 6ebe398..b8b592e 100644
--- a/kernel/Dockerfile
+++ b/kernel/Dockerfile
@@ -27,11 +27,20 @@ FROM --platform=linux/arm64 debian:${DEBIAN_SUITE}
 ARG DEBIAN_SUITE=bookworm
 
 # The raspberrypi kernel/headers live in the raspberrypi.com archive, not Debian.
+#
+# On trixie, apt verifies signatures with Sequoia (sqv), whose crypto policy
+# rejects SHA1 since 2026-02-01. The raspberrypi archive key's binding
+# self-signature is SHA1, so trixie's apt refuses the repo as "not signed"
+# (bookworm's gpgv doesn't enforce this). We mark the repo trusted=yes *only on
+# trixie* to bypass that check; bookworm keeps full signature verification. The
+# key is still fetched over HTTPS and pinned via signed-by where it is honoured.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates curl gnupg \
  && curl -fsSL https://archive.raspberrypi.com/debian/raspberrypi.gpg.key \
       | gpg --dearmor -o /usr/share/keyrings/raspberrypi-archive-keyring.gpg \
- && echo "deb [signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg] http://archive.raspberrypi.com/debian/ ${DEBIAN_SUITE} main" \
+ && opts="signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg" \
+ && if [ "$DEBIAN_SUITE" = "trixie" ]; then opts="$opts trusted=yes"; fi \
+ && echo "deb [$opts] http://archive.raspberrypi.com/debian/ ${DEBIAN_SUITE} main" \
       > /etc/apt/sources.list.d/raspi.list \
  && rm -rf /var/lib/apt/lists/*