diff --git a/src/SQLInsight.Agent/Hub/HubOptions.cs b/src/SQLInsight.Agent/Hub/HubOptions.cs
index 174bad3..3486298 100644
--- a/src/SQLInsight.Agent/Hub/HubOptions.cs
+++ b/src/SQLInsight.Agent/Hub/HubOptions.cs
@@ -10,7 +10,7 @@ public sealed class HubOptions
 
     public bool Enabled { get; set; }
 
-    /// <summary>Base URL of SQLInsight Hub, e.g. https://hub.seosoft.dk/.</summary>
+    /// <summary>Base URL of SQLInsight Hub, e.g. https://hub.sqlinsight.seosoft.dk/.</summary>
     public Uri? Url { get; set; }
 
     /// <summary>The license text (SQLI1.…).</summary>
diff --git a/src/SQLInsight.Agent/appsettings.json b/src/SQLInsight.Agent/appsettings.json
index 8af2b29..a8c643a 100644
--- a/src/SQLInsight.Agent/appsettings.json
+++ b/src/SQLInsight.Agent/appsettings.json
@@ -15,7 +15,7 @@
     },
     "Hub": {
       "Enabled": false,
-      "Url": "https://hub.seosoft.dk/",
+      "Url": "https://hub.sqlinsight.seosoft.dk/",
       "License": null,
       "SendSensitiveEvidence": false,
       "SendServerName": false,
diff --git a/src/SQLInsight.Licensing/trusted-keys.json b/src/SQLInsight.Licensing/trusted-keys.json
index 384f331..46a5552 100644
--- a/src/SQLInsight.Licensing/trusted-keys.json
+++ b/src/SQLInsight.Licensing/trusted-keys.json
@@ -1,4 +1,6 @@
 {
-  "comment": "Public keys trusted to sign licenses and update manifests. Deliberately empty in source: the vendor generates a key pair with SQLInsight.LicenseTool (keygen) and adds the PUBLIC key here before building a release. The private key never goes into the repository.",
-  "keys": []
+  "comment": "Public keys trusted to sign licenses and update manifests. The vendor generates a key pair with SQLInsight.LicenseTool (keygen) and adds the PUBLIC key here. The private key never goes into the repository.",
+  "keys": [
+    { "id": "k20261001", "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPXpGrrrvlDm3UvDqAILGpEcxoHsJ1M+blxLmBdWofjYZsg5q7B1ELG9Vw4cf9B6k9ngoJtA4SNx7HbctNwJAyQ==" }
+  ]
 }
diff --git a/tests/SQLInsight.Licensing.Tests/LicenseTests.cs b/tests/SQLInsight.Licensing.Tests/LicenseTests.cs
index 235cfd1..ad0668e 100644
--- a/tests/SQLInsight.Licensing.Tests/LicenseTests.cs
+++ b/tests/SQLInsight.Licensing.Tests/LicenseTests.cs
@@ -117,9 +117,21 @@ public class LicenseTests
     }
 
     [Fact]
-    public void Source_ships_without_trusted_keys()
+    public void Embedded_keys_are_vendor_public_keys()
     {
-        // The vendor adds its public key before a release; a published test key would let anyone mint licenses.
-        Assert.Equal(0, TrustedKeys.Embedded().Count);
+        // Only SEOSoft's keygen public keys may ship. A test key (whose private half is in a repository) would let
+        // anyone mint licenses, so every entry must look like keygen output: id k<yyyyMMdd> and a P-256 public key.
+        using var stream = typeof(TrustedKeys).Assembly.GetManifestResourceStream("SQLInsight.Licensing.trusted-keys.json")!;
+        using var document = System.Text.Json.JsonDocument.Parse(stream);
+        var keys = document.RootElement.GetProperty("keys").EnumerateArray().ToList();
+
+        Assert.Equal(keys.Count, TrustedKeys.Embedded().Count);
+        foreach (var entry in keys)
+        {
+            Assert.Matches(@"^k\d{8}$", entry.GetProperty("id").GetString());
+            using var key = ECDsa.Create();
+            key.ImportSubjectPublicKeyInfo(Convert.FromBase64String(entry.GetProperty("publicKey").GetString()!), out _);
+            Assert.Equal(256, key.KeySize);
+        }
     }
 }