diff --git a/tool/depot/mk/gpg.inc b/tool/depot/mk/gpg.inc
index a432ded9d..e78ac11ea 100644
--- a/tool/depot/mk/gpg.inc
+++ b/tool/depot/mk/gpg.inc
@@ -19,3 +19,6 @@ missing_pubkey_files:
 	@echo "Error: missing public-key files:";\
 	 for i in $(MISSING_PUBKEY_FILES); do echo "       $$i"; done; false
 
+# Allow the gpg command to be overridden on the command line
+GPG ?= gpg
+
diff --git a/tool/depot/publish b/tool/depot/publish
index 1357a7902..d5b96a135 100755
--- a/tool/depot/publish
+++ b/tool/depot/publish
@@ -72,8 +72,8 @@ TARGETS := $(addsuffix .tar.xz.sig,$(addprefix $(PUBLIC_DIR)/,$(ARCHIVES)))
 
 $(PUBLIC_DIR)/%.tar.xz.sig : $(PUBLIC_DIR)/%.tar.xz
 	$(VERBOSE)rm -f $@;
-	$(VERBOSE)gpg --detach-sign --digest-algo SHA256 --no-tty --use-agent \
-	              --local-user $(call pubkey_id,$*) $<
+	$(VERBOSE)$(GPG) --detach-sign --digest-algo SHA256 --no-tty --use-agent \
+	              --local-user $(call pubkey_id,$*) - < $< > $@
 
 .PRECIOUS: $(TARGETS:.tar.xz.sig=.tar.xz)