diff --git a/lib/apt.sh b/lib/apt.sh
index ac4c8f8..3027294 100755
--- a/lib/apt.sh
+++ b/lib/apt.sh
@@ -46,8 +46,8 @@ apt_add_keyring_from_url() {
     if curl -fsSL "$url" -o "$tmp_key"; then
         # Check if the key is ASCII armored or binary
         if gpg --dry-run --quiet --import "$tmp_key" >/dev/null 2>&1; then
-            if file "$tmp_key" | grep -q "PGP public key block"; then
-                gpg --dearmor -o "$dest_path" < "$tmp_key" 2>/dev/null || cp "$tmp_key" "$dest_path"
+            if grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$tmp_key"; then
+                gpg --dearmor --yes --batch -o "$dest_path" < "$tmp_key" 2>/dev/null || cp "$tmp_key" "$dest_path"
             else
                 cp "$tmp_key" "$dest_path"
             fi
diff --git a/stages/05-fonts.sh b/stages/05-fonts.sh
index 9d04e66..cc0a2da 100755
--- a/stages/05-fonts.sh
+++ b/stages/05-fonts.sh
@@ -24,7 +24,7 @@ cleanup() {
         rm -rf "$TEMP_DIR"
     fi
 }
-trap cleanup EXIT ERR
+trap cleanup EXIT
 
 mkdir -p "$FONT_DIR"
 
diff --git a/stages/06-services.sh b/stages/06-services.sh
index 3d75697..c695e8d 100755
--- a/stages/06-services.sh
+++ b/stages/06-services.sh
@@ -37,11 +37,11 @@ log_substep "Setting up Docker service & repository..."
 apt_ensure_keyrings_dir
 apt_add_keyring_from_url "https://download.docker.com/linux/debian/gpg" "docker.asc"
 
-DEBIAN_CODENAME="sid"
+DEBIAN_CODENAME="trixie"
 if [[ -f /etc/os-release ]]; then
     # shellcheck source=/dev/null
     source /etc/os-release
-    DEBIAN_CODENAME="${VERSION_CODENAME:-sid}"
+    DEBIAN_CODENAME="${VERSION_CODENAME:-trixie}"
     # Docker uses 'bookworm' or 'trixie' upstream repo suite for Debian testing/unstable if sid is not explicitly provided
     if [[ "$DEBIAN_CODENAME" == "sid" ]]; then
         DEBIAN_CODENAME="trixie"
diff --git a/stages/08-flatpaks-apps.sh b/stages/08-flatpaks-apps.sh
index 2326137..933b470 100755
--- a/stages/08-flatpaks-apps.sh
+++ b/stages/08-flatpaks-apps.sh
@@ -40,9 +40,7 @@ fi
 
 # 3. Spotify Client Installation (Debian APT repo)
 log_substep "Configuring Spotify repository and client..."
-apt_ensure_keyrings_dir
-if curl -fsSL https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.asc | gpg --dearmor -o /etc/apt/keyrings/spotify.gpg 2>/dev/null; then
-    chmod 0644 /etc/apt/keyrings/spotify.gpg
+if apt_add_keyring_from_url "https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.asc" "spotify.gpg"; then
     cat <<EOF > /etc/apt/sources.list.d/spotify.sources
 Types: deb
 URIs: http://repository.spotify.com