diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index c0621e9..2ea310f 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -47,7 +47,9 @@ steps:
       tag="${TANGLED_REF_NAME}"   # the pushed tag, e.g. v1.2.3
       creds="${ATCR_HANDLE}:${ATCR_APP_PASSWORD}"
 
-      skopeo copy --dest-creds "$creds" \
+      # --insecure-policy selects skopeo's built-in accept-anything signature
+      # policy; the Nix environment ships no /etc/containers/policy.json.
+      skopeo --insecure-policy copy --dest-creds "$creds" \
         "docker-archive:$(readlink -f result)" "docker://${image}:${tag}"
-      skopeo copy --dest-creds "$creds" \
+      skopeo --insecure-policy copy --dest-creds "$creds" \
         "docker-archive:$(readlink -f result)" "docker://${image}:latest"