diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 27583f64c..2d0eeedfe 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -87,8 +87,14 @@ jobs:
           printf 'pinentry-mode loopback\npassphrase-file /root/repo_pass\n' > /root/.gnupg/gpg.conf
           printf 'allow-loopback-pinentry\n' > /root/.gnupg/gpg-agent.conf
           gpg-connect-agent reloadagent /bye
+          # exclude .sig files from repo-add's positional args
+          pkgs=()
+          for ext in xz zst gz; do
+            for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
+          done
+          echo "packages to add: ${pkgs[*]}"
           repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
-            --verify marfrit.db.tar.gz *.pkg.tar.*
+            --verify marfrit.db.tar.gz "${pkgs[@]}"
           # refresh "unversioned" symlinks expected by pacman
           ln -sf marfrit.db.tar.gz     marfrit.db
           ln -sf marfrit.files.tar.gz  marfrit.files