diff --git a/.config/shell/utils.d/update.sh b/.config/shell/utils.d/update.sh
index 651c0f9..42951ec 100644
--- a/.config/shell/utils.d/update.sh
+++ b/.config/shell/utils.d/update.sh
@@ -139,6 +139,23 @@ _restore_gnome() {
 
 
 
+_fix_locations() {
+
+    # Gnome Seahorse (i.e., "Keyrings") uses ~/.pki by default but also
+    # detects $XDG_DATA_HOME/pki if it is there and uses it insead;
+    # setting this explicitly via an environment variable is not possible
+    if [ -d "$HOME/.pki" ]; then
+        if [ -d "$XDG_DATA_HOME/pki" ]; then
+            echo "Warning: both $HOME/.pki and $XDG_DATA_HOME/pki exist!"
+        else
+            mv "$HOME/.pki" "$XDG_DATA_HOME/pki"
+        fi
+    fi
+
+}
+
+
+
 run-private-scripts() {  # in the Nextcloud
     sudo --validate || return
 
@@ -162,6 +179,7 @@ update-machine() {
     _update_zsh
     _update_python
     _restore_gnome
+    _fix_locations
     run-private-scripts
 
     sudo --reset-timestamp
diff --git a/.local/share/pki/.gitkeep b/.local/share/pki/.gitkeep
new file mode 100644
index 0000000..e69de29