diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index 2ea20cc8623..66367b2e211 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -16,7 +16,7 @@ on:
       tag_name:
         required: true
         type: string
-        description: "The tag name for the release (e.g. v2.100.0)."
+        description: "The tag name for the release (e.g. v2.100.0, or v2.100.0-rc.1 for a pre-release)."
       environment:
         default: production
         type: environment
@@ -42,8 +42,9 @@ jobs:
         env:
           TAG_NAME: ${{ inputs.tag_name }}
         run: |
-          if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid tag name format. Must be in the form v1.2.3"
+          # Build metadata (v1.2.3+001) is rejected: later steps detect a pre-release by its hyphen.
+          if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            echo "Invalid tag name format. Must be in the form v1.2.3 or v1.2.3-rc.1"
             exit 1
           fi
   linux:
@@ -375,12 +376,19 @@ jobs:
           GPG_KEY: ${{ secrets.GPG_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           GPG_KEYGRIP: ${{ secrets.GPG_KEYGRIP }}
+          GPG_PUBKEY_2026: ${{ secrets.GPG_PUBKEY_2026 }}
+          GPG_KEY_2026: ${{ secrets.GPG_KEY_2026 }}
+          GPG_PASSPHRASE_2026: ${{ secrets.GPG_PASSPHRASE_2026 }}
+          GPG_KEYGRIP_2026: ${{ secrets.GPG_KEYGRIP_2026 }}
         run: |
           base64 -d <<<"$GPG_PUBKEY" | gpg --import --no-tty --batch --yes
           base64 -d <<<"$GPG_KEY" | gpg --import --no-tty --batch --yes
+          base64 -d <<<"$GPG_PUBKEY_2026" | gpg --import --no-tty --batch --yes
+          base64 -d <<<"$GPG_KEY_2026" | gpg --import --no-tty --batch --yes
           echo "allow-preset-passphrase" > ~/.gnupg/gpg-agent.conf
           gpg-connect-agent RELOADAGENT /bye
           base64 -d <<<"$GPG_PASSPHRASE" | /usr/lib/gnupg2/gpg-preset-passphrase --preset "$GPG_KEYGRIP"
+          base64 -d <<<"$GPG_PASSPHRASE_2026" | /usr/lib/gnupg2/gpg-preset-passphrase --preset "$GPG_KEYGRIP_2026"
       - name: Sign RPMs
         if: inputs.environment == 'production'
         run: |
@@ -400,7 +408,7 @@ jobs:
           ./script/createrepo.sh
           cp -r dist/repodata site/packages/rpm/
           pushd site/packages/rpm
-          gpg --yes --detach-sign --armor repodata/repomd.xml
+          gpg --yes --detach-sign --armor --default-key 2C6106201985B60E6C7AC87323F3D4EA75716059 repodata/repomd.xml
           popd
       - name: Run reprepro
         if: ${{ inputs.environment == 'production' }}
diff --git a/docs/release-process-deep-dive.md b/docs/release-process-deep-dive.md
index cd871e20e6a..70fbd83aadc 100644
--- a/docs/release-process-deep-dive.md
+++ b/docs/release-process-deep-dive.md
@@ -38,18 +38,20 @@ Although this workflow is used to do our production releases for Linux, MacOS an
     runs-on: ubuntu-latest
     steps:
       - name: Validate tag name format
+        env:
+          TAG_NAME: ${{ inputs.tag_name }}
         run: |
-          if [[ ! "${{ inputs.tag_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid tag name format. Must be in the form v1.2.3"
+          if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            echo "Invalid tag name format. Must be in the form v1.2.3 or v1.2.3-rc.1"
             exit 1
           fi
 ```
 </details>
 
-The purpose of this job is to [prevent incorrectly tagged releases](https://github.com/cli/cli/pull/10121), by ensuring they conform to the `major.minor.patch` form of semantic versioning, preceded by a `v`.
+The purpose of this job is to [prevent incorrectly tagged releases](https://github.com/cli/cli/pull/10121), by ensuring they conform to the `major.minor.patch` form of semantic versioning, preceded by a `v`. An optional pre-release suffix such as `-rc.1` is allowed. Build metadata after a `+` is not, because the rest of the workflow identifies a pre-release by looking for a hyphen.
 
-> [!WARNING]
-> The `release` job can [create the GitHub release as a pre-release based on the existence of a hyphen in the tag name](https://github.com/cli/cli/blob/756f4ec04abdc9fdbab3fef35b182c546ef1dd17/.github/workflows/deployment.yml#L362-L364), but the later addition of `validate-tag-name` disallows this.
+> [!NOTE]
+> A hyphen in the tag name changes three things: the `release` job [creates the GitHub release as a pre-release](https://github.com/cli/cli/blob/756f4ec04abdc9fdbab3fef35b182c546ef1dd17/.github/workflows/deployment.yml#L362-L364), the site is not published, and the Windows MSI drops the suffix so its `ProductVersion` stays numeric.
 
 ## <a id="os-builds">[OS Builds](https://github.com/cli/cli/blob/756f4ec04abdc9fdbab3fef35b182c546ef1dd17/.github/workflows/deployment.yml#L40-L248)</a>
 
diff --git a/script/distributions b/script/distributions
index 5f45813a5c0..d18d15aaf5a 100644
--- a/script/distributions
+++ b/script/distributions
@@ -4,7 +4,7 @@ Codename: stable
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian stable repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -12,7 +12,7 @@ Codename: oldstable
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian oldstable repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -20,7 +20,7 @@ Codename: testing
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian testing repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -28,7 +28,7 @@ Codename: unstable
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian unstable repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -36,7 +36,7 @@ Codename: sid
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian unstable repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -44,7 +44,7 @@ Codename: buster
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian buster repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -52,7 +52,7 @@ Codename: bullseye
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian bullseye repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -60,7 +60,7 @@ Codename: stretch
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian stretch repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -68,7 +68,7 @@ Codename: jessie
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - debian jessie repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -76,7 +76,7 @@ Codename: focal
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu focal repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -85,7 +85,7 @@ Codename: precise
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu precise repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -94,7 +94,7 @@ Codename: bionic
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu bionic repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -103,7 +103,7 @@ Codename: trusty
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu trusty repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -112,7 +112,7 @@ Codename: xenial
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu xenial repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -121,7 +121,7 @@ Codename: groovy
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu groovy repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -130,7 +130,7 @@ Codename: eoan
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu eoan repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -139,7 +139,7 @@ Codename: disco
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu disco repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -148,7 +148,7 @@ Codename: cosmic
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu cosmic repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -157,7 +157,7 @@ Codename: hirsute
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu hirsute repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
 
 Origin: gh
@@ -166,7 +166,7 @@ Codename: kali-rolling
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - kali repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 
 Origin: gh
 Label: gh
@@ -174,5 +174,5 @@ Codename: impish
 Architectures: i386 amd64 armhf arm64
 Components: main
 Description: The GitHub CLI - ubuntu impish repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325
 DebOverride: override.ubuntu
diff --git a/script/rpmmacros b/script/rpmmacros
index f2fdd6de373..8a691d41a55 100644
--- a/script/rpmmacros
+++ b/script/rpmmacros
@@ -1 +1 @@
-%_gpg_name GitHub CLI <opensource+cli@github.com>
+%_gpg_name 2C6106201985B60E6C7AC87323F3D4EA75716059