diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ddd174..e3bdeb4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -127,9 +127,24 @@ jobs:
             --commit-dirty=true
 
       - name: Commit generated docs
+        env:
+          BOT_GPG_KEY: ${{ secrets.CI_GPG_PRIVATE_KEY }}
         run: |
-          git config user.name  "Gitea Actions"
-          git config user.email "actions@gitea"
+          # actions@gitea was never a verified email on any account, so
+          # these commits could never show as signed/verified regardless
+          # of server config. fishconfig-bot is a dedicated Gitea account
+          # (verified email, no login) that owns this key; the private
+          # key lives only in the CI_GPG_PRIVATE_KEY repo secret.
+          export GNUPGHOME="$(mktemp -d)"
+          chmod 700 "$GNUPGHOME"
+          echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
+          echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
+          command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg
+          echo "$BOT_GPG_KEY" | gpg --batch --import
+          git config user.name  "Gitea Actions Bot"
+          git config user.email "fishconfig-bot@git.rootiest.dev"
+          git config user.signingkey 0603CD87750C18FB3604147EFD08763FA41E5534
+          git config commit.gpgsign true
           git add docs/fish-config.md docs/fish-config.1 conf.d/__fish_config_op_registry.fish
           git diff --cached --quiet && echo "No changes to commit" && exit 0
           git commit -m "chore(docs): regenerate manual, man page, and component registry"