diff --git a/tool/depot/publish b/tool/depot/publish
index 5a928fe90..438fb9e01 100755
--- a/tool/depot/publish
+++ b/tool/depot/publish
@@ -69,7 +69,8 @@ TARGETS := $(addsuffix .tar.xz.sig,$(addprefix $(PUBLIC_DIR)/,$(ARCHIVES)))
 
 $(PUBLIC_DIR)/%.tar.xz.sig : $(PUBLIC_DIR)/%.tar.xz
 	$(VERBOSE)rm -f $@;
-	$(VERBOSE)gpg --detach-sign --no-tty --use-agent --local-user $(call pubkey_id,$*) $<
+	$(VERBOSE)gpg --detach-sign --digest-algo SHA256 --no-tty --use-agent \
+	              --local-user $(call pubkey_id,$*) $<
 
 .PRECIOUS: $(TARGETS:.tar.xz.sig=.tar.xz)