diff --git a/release/scripts/make-oci-image.sh b/release/scripts/make-oci-image.sh
--- a/release/scripts/make-oci-image.sh
+++ b/release/scripts/make-oci-image.sh
@@ -39,10 +39,18 @@
 	local abi=$1; shift
 	local workdir=$1; shift
 	local rootdir=${workdir}/rootfs
+
+	# Make sure we have the keys needed for verifying package integrity if
+	# not already added by a parent image.
 	if [ ! -d ${rootdir}/usr/share/keys/pkg/trusted ]; then
 		mkdir -p ${rootdir}/usr/share/keys/pkg/trusted
 	fi
-	cp /usr/share/keys/pkg/trusted/* ${rootdir}/usr/share/keys/pkg/trusted
+	for i in ${curdir}/../share/keys/pkg/trusted/pkg.*; do
+		if [ ! -f ${rootdir}/usr/share/keys/pkg/trusted/$(basename $i) ]; then
+			cp $i ${rootdir}/usr/share/keys/pkg/trusted
+		fi
+	done
+
 	# We install the packages and then remove repository metadata (keeping the
 	# metadata for what was installed). This trims more than 40Mb from the
 	# resulting image.
diff --git a/release/tools/oci-image-runtime.conf b/release/tools/oci-image-runtime.conf
--- a/release/tools/oci-image-runtime.conf
+++ b/release/tools/oci-image-runtime.conf
@@ -9,6 +9,10 @@
 
 oci_image_build() {
 	set_cmd ${workdir} /bin/sh
+	# The static image installed termcap.small into /usr/share/misc/termcap
+	# and we are replacing it with the full termcap file. We remove the
+	# small one first to avoid creating a .pkgsave file.
+	rm ${workdir}/rootfs/usr/share/misc/termcap
 	install_packages ${abi} ${workdir} \
 			 FreeBSD-runtime \
 			 FreeBSD-certctl \