diff --git a/config.org b/config.org
index dab990e..fd6cbc8 100644
--- a/config.org
+++ b/config.org
@@ -217,21 +217,35 @@ These services are unmodified, or have just few settings.
   (public-key (ecc (curve Ed25519) (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))
 #+end_src
 
+#+NAME: guix-ci-pubkey
+#+begin_src scheme :tangle keys/guix-ci.pub :mkdirp yes
+(public-key (ecc (curve Ed25519) (q #8D156F295D24B0D9A86FA5741A840FF2D24F60F7B6C4134814AD55625971B394#)))
+#+end_src
+
+#+NAME: guix-bordeaux-pubkey
+#+begin_src scheme :tangle keys/guix-bordeaux.pub :mkdirp yes
+(public-key (ecc (curve Ed25519) (q #7D602902D3A2DBB83F8A0FB98602A754C5493B0B778C8D1DD4E0F41DE14DE34F#)))
+#+end_src
+
 #+NAME: root-modified-desktop-services
 #+begin_src scheme :exports none :results code :noweb no-export
-    (modify-services
-     %desktop-services
-     (delete login-service-type)
-     (delete mingetty-service-type)
-     (delete console-font-service-type)
-     (guix-service-type config => (guix-configuration
-                                   (inherit config)
-                                   (substitute-urls
-                                    (append (list "https://substitutes.nonguix.org")
-                                            %default-substitute-urls))
-                                   (authorized-keys
-                                    (append (list (plain-file "non-guix.pub"
-                                                              "<<nonguix-pubkey>>")))))))
+  (modify-services
+   %desktop-services
+   (delete login-service-type)
+   (delete mingetty-service-type)
+   (delete console-font-service-type)
+   (guix-service-type config => (guix-configuration
+                                 (inherit config)
+                                 (substitute-urls
+                                  (append (list "https://substitutes.nonguix.org")
+                                          %default-substitute-urls))
+                                 (authorized-keys
+                                  (append (list (plain-file "non-guix.pub"
+                                                            "<<nonguix-pubkey>>")
+                                                (plain-file "guix-ci.pub"
+                                                            "<<guix-ci-pubkey>>")
+                                                (plain-file "guix-bordeaux.pub"
+                                                            "<<guix-bordeaux-pubkey>>")))))))
 #+end_src
 
 *** Greeter Service
diff --git a/config.scm b/config.scm
index 0bacc32..e5ff43b 100644
--- a/config.scm
+++ b/config.scm
@@ -152,7 +152,11 @@
                                             %default-substitute-urls))
                                    (authorized-keys
                                     (append (list (plain-file "non-guix.pub"
-                                                              "(public-key (ecc (curve Ed25519) (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))")))))))
+                                                              "(public-key (ecc (curve Ed25519) (q #C1FD53E5D4CE971933EC50C9F307AE2171A2D3B52C804642A7A35F84F3A4EA98#)))")
+                                                  (plain-file "guix-ci.pub"
+                                                              "(public-key (ecc (curve Ed25519) (q #8D156F295D24B0D9A86FA5741A840FF2D24F60F7B6C4134814AD55625971B394#)))")
+                                                  (plain-file "guix-bordeaux.pub"
+                                                              "(public-key (ecc (curve Ed25519) (q #7D602902D3A2DBB83F8A0FB98602A754C5493B0B778C8D1DD4E0F41DE14DE34F#)))")))))))
     (list (service tlp-service-type (tlp-configuration))
           (service
             thermald-service-type
diff --git a/keys/guix-bordeaux.pub b/keys/guix-bordeaux.pub
new file mode 100644
index 0000000..ad9182d
--- /dev/null
+++ b/keys/guix-bordeaux.pub
@@ -0,0 +1,7 @@
+
+
+;; #+NAME: guix-bordeaux-pubkey
+
+;; [[file:../config.org::guix-bordeaux-pubkey][guix-bordeaux-pubkey]]
+(public-key (ecc (curve Ed25519) (q #7D602902D3A2DBB83F8A0FB98602A754C5493B0B778C8D1DD4E0F41DE14DE34F#)))
+;; guix-bordeaux-pubkey ends here
diff --git a/keys/guix-ci.pub b/keys/guix-ci.pub
new file mode 100644
index 0000000..620d0ef
--- /dev/null
+++ b/keys/guix-ci.pub
@@ -0,0 +1,7 @@
+
+
+;; #+NAME: guix-ci-pubkey
+
+;; [[file:../config.org::guix-ci-pubkey][guix-ci-pubkey]]
+(public-key (ecc (curve Ed25519) (q #8D156F295D24B0D9A86FA5741A840FF2D24F60F7B6C4134814AD55625971B394#)))
+;; guix-ci-pubkey ends here