diff --git a/lib/beaker/hypervisor/docker.rb b/lib/beaker/hypervisor/docker.rb
index <HASH>..<HASH> 100644
--- a/lib/beaker/hypervisor/docker.rb
+++ b/lib/beaker/hypervisor/docker.rb
@@ -279,6 +279,7 @@ module Beaker
           EOF
         when /archlinux/
           dockerfile += <<-EOF
+            RUN pacman --noconfirm -Sy archlinux-keyring
             RUN pacman --noconfirm -Syu
             RUN pacman -S --noconfirm openssh #{Beaker::HostPrebuiltSteps::ARCHLINUX_PACKAGES.join(' ')}
             RUN ssh-keygen -A
update the arch keyring before other updates

It is possible that the updates are signed by a gpg key that is missing
in the keyring. So the keyring needs to be updated first. This is a
known issue on archlinux systems that aren't updated frequently.