diff --git a/src/ingest/relay/context.rs b/src/ingest/relay/context.rs
index a30c122..e210a93 100644
--- a/src/ingest/relay/context.rs
+++ b/src/ingest/relay/context.rs
@@ -173,7 +173,11 @@ impl WorkerContext<'_> {
                 trace!("skipping replayed commit");
                 return Ok(None);
             }
-            Err(CommitValidationError::SigFailure) => {}
+            // a sig failure may just mean our cached signing key is stale;
+            // refresh the identity doc and retry before treating it as a real failure.
+            Err(CommitValidationError::SigFailure) => {
+                debug!(%did, "commit signature failed, refreshing signing key");
+            }
             Err(e) => {
                 debug!(err = %e, "commit rejected");
                 return Ok(None);
@@ -190,6 +194,10 @@ impl WorkerContext<'_> {
         );
         match validation {
             Ok(v) => Ok(Some(v)),
+            Err(CommitValidationError::SigFailure) => {
+                warn!(%did, "commit signature verification failed after key refresh");
+                Ok(None)
+            }
             Err(e) => {
                 debug!(err = %e, "commit rejected after key refresh");
                 Ok(None)
@@ -212,7 +220,11 @@ impl WorkerContext<'_> {
         );
         match validation {
             Ok(v) => return Ok(Some(v)),
-            Err(SyncValidationError::SigFailure) => {}
+            // a sig failure may just mean our cached signing key is stale;
+            // refresh the identity doc and retry before treating it as a real failure.
+            Err(SyncValidationError::SigFailure) => {
+                debug!(%did, "sync signature failed, refreshing signing key");
+            }
             Err(e) => {
                 debug!(err = %e, "sync rejected");
                 return Ok(None);
@@ -229,6 +241,10 @@ impl WorkerContext<'_> {
         );
         match validation {
             Ok(v) => Ok(Some(v)),
+            Err(SyncValidationError::SigFailure) => {
+                warn!(%did, "sync signature verification failed after key refresh");
+                Ok(None)
+            }
             Err(e) => {
                 debug!(err = %e, "sync rejected after key refresh");
                 Ok(None)