-# deb http://deb.grml.org/ grml-stable main
-# deb-src http://deb.grml.org/ grml-stable main
-# deb http://deb.grml.org/ grml-testing main
-# deb-src http://deb.grml.org/ grml-testing main</pre>
+# deb [signed-by=/usr/share/keyrings/grml-archive-keyring.gpg] http://deb.grml.org/ grml-stable main
+# deb-src [signed-by=/usr/share/keyrings/grml-archive-keyring.gpg] http://deb.grml.org/ grml-stable main
+# deb [signed-by=/usr/share/keyrings/grml-archive-keyring.gpg] http://deb.grml.org/ grml-testing main
+# deb-src [signed-by=/usr/share/keyrings/grml-archive-keyring.gpg] http://deb.grml.org/ grml-testing main</pre>
+
+ <p>If you are running Debian stretch or later, you may want to use the following <code>.sources</code> file, which will enforce the suite name and signing keys:</p>
+
+ <pre class="rahmen">
+Types: deb deb-src
+URIs: http://deb.grml.org/
+Suites: grml-stable grml-testing
+Architectures: i386 amd64
+Components: main
+Signed-By: /usr/share/keyrings/grml-archive-keyring.gpg</pre>
+
+ <p>Then the following <a href="https://manpages.debian.org/apt_preferences">preferences file</a> will keep packages from GRML to replace normal Debian packages, in <code>/etc/apt/preferences.d/grml.pref</code>:</p>
+
+ <pre class="rahmen">
+Package: *
+Pin: release a=grml-stable
+Pin-Priority: 100
+
+Package: *
+Pin: release a=grml-testing
+Pin-Priority: 100</pre>
+
+ <p>Also note that you may have trouble installing the <code>grml-debian-keyring</code> package as APT will complain about the missing key. A workaround is to download it directly:</p>
+
+ <pre class="rahmen">
+sudo wget -O /usr/share/keyrings/grml-archive-keyring.gpg https://deb.grml.org/repo-key.gpg
+sudo apt-get update
+sudo apt-get install grml-debian-keyring
+</pre>