diff --git a/.github/workflows/build-bluebuild.yml b/.github/workflows/build-bluebuild.yml
index 95b5f81..62b9726 100644
--- a/.github/workflows/build-bluebuild.yml
+++ b/.github/workflows/build-bluebuild.yml
@@ -164,6 +164,10 @@ jobs:
           cp "$AUTH_SRC" /root/.config/containers/auth.json
           ls -la /root/.config/containers/auth.json
 
+          # Diagnostic: confirm the keypair landed where bluebuild expects.
+          ls -la bluebuild/
+          file bluebuild/cosign.pub bluebuild/cosign.key 2>&1 | head -4
+
           podman run --rm \
             --privileged \
             --entrypoint /usr/bin/bluebuild \
@@ -175,6 +179,7 @@ jobs:
             ghcr.io/blue-build/cli:latest \
             build \
               --build-driver buildah \
+              -vv \
               bluebuild/recipe.yml
           # bluebuild CLI tags as <recipe-name>:<tag> in local podman
           # storage. List + verify, then re-tag for the registries.