diff --git a/bcc_core.py b/bcc_core.py
index d207ab4..699c8cf 100644
--- a/bcc_core.py
+++ b/bcc_core.py
@@ -13,6 +13,7 @@ in its original position.
 
 from __future__ import annotations
 
+import base64
 import contextlib
 import difflib
 import functools
@@ -2168,7 +2169,7 @@ CATALOG_ALLOWED_COMMANDS = frozenset({"npx", "uvx", "docker", "node", "python",
 # still trust an older key: verify_catalog_signature() accepts a match
 # against ANY key in this list.
 CATALOG_PUBKEYS: list[bytes] = [
-    b"\x00" * 32,  # TODO: real key from Catalog Console (#62)
+    base64.b64decode("082NOwVB7uURkvfyS3+knJ+40Fk6C9unsF47+2uPKo4="),
 ]
 
 # Domain-separation prefix for the signed message. The signature covers