diff --git a/projects/ArchR/packages/sysutils/pacman/config/pacman.conf b/projects/ArchR/packages/sysutils/pacman/config/pacman.conf
index 24a84d17ed..6869965ee3 100644
--- a/projects/ArchR/packages/sysutils/pacman/config/pacman.conf
+++ b/projects/ArchR/packages/sysutils/pacman/config/pacman.conf
@@ -17,10 +17,16 @@ HookDir     = /etc/pacman.d/hooks/
 HoldPkg     = pacman glibc bash linux archr-keyring
 Architecture = aarch64
 
-# Signature checking. Required is the target once archr-keyring ships
-# the production master key; DatabaseOptional during bootstrap because
-# the .db files in the first releases may not be signed yet.
-SigLevel    = Required DatabaseOptional
+# Signature checking. The archr repo signs the database (.db) with the
+# production master subkey; individual packages are unsigned because
+# GitHub Releases caps a single release at 1000 assets and the per-pkg
+# .sig files double the count past that limit. The trust path is:
+#   1. archr-keyring ships the master public key.
+#   2. archr.db.sig proves the db came from us.
+#   3. The db lists SHA256 of every package; pacman re-hashes after
+#      download and refuses mismatches.
+# This is the same model Arch Linux ARM, EndeavourOS and SteamOS use.
+SigLevel    = PackageOptional DatabaseRequired
 LocalFileSigLevel = Optional
 
 CheckSpace
diff --git a/scripts/repo/gen-pacman-repo b/scripts/repo/gen-pacman-repo
index 63fe6564a9..4cef162cda 100755
--- a/scripts/repo/gen-pacman-repo
+++ b/scripts/repo/gen-pacman-repo
@@ -123,9 +123,12 @@ EOF
     )
     rm -f "${pkginfo}"
 
-    if [ -n "${SIGNER}" ]; then
-        gpg --batch --yes --detach-sign --use-agent --local-user "${SIGNER}" "${outfile}"
-    fi
+    # Per-package signing is intentionally NOT done here. The repo db
+    # carries the SHA256 of every pkg.tar.zst and is itself GPG-signed,
+    # which gives pacman an unbroken trust chain without doubling the
+    # asset count on GitHub Releases (1000-per-release cap).
+    # The signer is still passed to repo-add below so the db gets its
+    # own .sig and trust flows from there.
 
     echo "  + ${name} ${version}-${pkgrel}"
 }