diff --git a/.gitignore b/.gitignore
index 637da79..795257c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,5 @@
 board/myna-player-odyssey/utilities/machine-id
 pki
 easy-rsa
-board/myna-player-odyssey/rootfs_overlay/etc/rauc/keyring.pem
 output/*
 dl/*
diff --git a/board/myna-player-odyssey/scripts/rootfs_postbuild.sh b/board/myna-player-odyssey/scripts/rootfs_postbuild.sh
index e73da18..ed95620 100755
--- a/board/myna-player-odyssey/scripts/rootfs_postbuild.sh
+++ b/board/myna-player-odyssey/scripts/rootfs_postbuild.sh
@@ -1,4 +1,7 @@
 #!/bin/sh
+
+set -e
+
 # setup machine-id
 
 cp "${BR2_EXTERNAL_MynaPlayer_PATH}"/board/myna-player-odyssey/utilities/machine-id \
@@ -27,3 +30,9 @@
 cp -a "${BASE_DIR}"/../kernel/stm32mp157c-odyssey.dtb \
 	"${BASE_DIR}"/../kernel/zImage \
 	"${TARGET_DIR}"/boot
+
+# grab keyring needed for rauc
+
+RAUC_KEYRING=$(awk '{print $3}' "${BR2_EXTERNAL_MynaPlayer_PATH}/board/myna-player-odyssey/utilities/certs.txt" | sed -n '1p')
+cp "${RAUC_KEYRING}" \
+	"${TARGET_DIR}"/etc/rauc/keyring.pem