diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index e90bc87..b89e7b4 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -4,11 +4,41 @@ set -euo pipefail
 SYNC_CRON="${SYNC_CRON:-0 */6 * * *}"
 GIT_SSH_KEY_PATH="${GIT_SSH_KEY_PATH:-/etc/mirror/git-deploy-key}"
 
-# Cron-Job mit den aktuellen Env-Variablen schreiben
+export GNUPGHOME="${GNUPGHOME:-/etc/mirror-gpg}"
+GPG_PRIVATE_KEY_FILE="${GPG_PRIVATE_KEY_FILE:-/run/secrets/gpg_private_key}"
+GPG_KEY_ID_FILE="${GNUPGHOME}/key-id"
+
+mkdir -p "$GNUPGHOME"
+chmod 700 "$GNUPGHOME"
+
+if [ -f "$GPG_PRIVATE_KEY_FILE" ] && [ ! -s "$GPG_KEY_ID_FILE" ]; then
+  echo "[entrypoint] Importiere Firmen-GPG-Key"
+  gpg --batch --import "$GPG_PRIVATE_KEY_FILE"
+  gpg --batch --list-secret-keys --with-colons \
+    | awk -F: '/^sec/ {print $5; exit}' > "$GPG_KEY_ID_FILE"
+fi
+
+if [ -s "$GPG_KEY_ID_FILE" ]; then
+  GPG_KEY_ID="$(cat "$GPG_KEY_ID_FILE")"
+  export GPG_KEY_ID
+
+  mkdir -p /data/repo
+  gpg --batch --export --armor "$GPG_KEY_ID" > /data/repo/RPM-GPG-KEY-firma
+
+  {
+    echo "%_gpg_name  ${GPG_KEY_ID}"
+    echo "%_gpg_path  ${GNUPGHOME}"
+  } > /root/.rpmmacros
+else
+  echo "[entrypoint] WARNUNG: kein GPG-Key gefunden, Pakete werden NICHT signiert."
+fi
+
 {
   echo "CONFIG_REPO_URL=${CONFIG_REPO_URL:-}"
   echo "CONFIG_REPO_BRANCH=${CONFIG_REPO_BRANCH:-main}"
   echo "GIT_SSH_KEY_PATH=${GIT_SSH_KEY_PATH}"
+  echo "GNUPGHOME=${GNUPGHOME}"
+  echo "GPG_KEY_ID=${GPG_KEY_ID:-}"
   echo "${SYNC_CRON} root /usr/local/bin/sync.sh >> /var/log/sync.log 2>&1"
 } > /etc/cron.d/repo-sync
 chmod 0644 /etc/cron.d/repo-sync
@@ -16,7 +46,6 @@ chmod 0644 /etc/cron.d/repo-sync
 touch /var/log/sync.log
 crond
 
-# Initialer Sync, damit das Repo beim ersten Start nicht leer ist
 /usr/local/bin/sync.sh || echo "[entrypoint] Initialer Sync fehlgeschlagen, Nginx startet trotzdem."
 
 exec nginx -g 'daemon off;'
\ No newline at end of file