diff --git a/roles/1password/tasks/Debian.yaml b/roles/1password/tasks/Debian.yaml
index a7f8351..95d26ff 100644
--- a/roles/1password/tasks/Debian.yaml
+++ b/roles/1password/tasks/Debian.yaml
@@ -1,16 +1,23 @@
 ---
-- set_fact:
-    keyring: /etc/apt/trusted.gpg.d/1password-archive-keyring.gpg
+- name: set keyring path
+  set_fact:
+    keyring: /etc/apt/keyrings/1password.asc
+    old_keyring: /etc/apt/trusted.gpg.d/1password-archive-keyring.gpg
+
+- name: remove old keyring
+  file:
+    path: '{{old_keyring}}'
+    state: absent
 
 - name: add apt signing key
   when: '"WSL" not in ansible_kernel'
   become: true
-  apt_key:
+  get_url:
     url: https://downloads.1password.com/linux/keys/1password.asc
-    keyring: '{{keyring}}'
-    state: present
+    dest: '{{keyring}}'
 
-- when: ansible_machine == 'x86_64'
+- name: set compatible architecture
+  when: ansible_machine == 'x86_64'
   set_fact:
     arch: amd64
 
diff --git a/roles/llvm/tasks/Ubuntu.yaml b/roles/llvm/tasks/Ubuntu.yaml
index f13bf8b..42e7159 100644
--- a/roles/llvm/tasks/Ubuntu.yaml
+++ b/roles/llvm/tasks/Ubuntu.yaml
@@ -25,11 +25,44 @@
       'http://apt.llvm.org/{{ubuntu_codename}}/'
     llvm_apt_category:
       'llvm-toolchain-{{ubuntu_codename}}-{{llvm_major_version}}'
+    keyring: '/etc/apt/keyrings/llvm.asc'
+
+- name: remove old keyring
+  when: '"WSL" not in ansible_kernel'
+  become: true
+  apt_key:
+    url: https://apt.llvm.org/llvm-snapshot.gpg.key
+    id: 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421
+    state: absent
+
+- name: remove old upstream deb repository
+  become: true
+  apt_repository:
+    repo: 'deb {{llvm_apt_repo_url}} {{llvm_apt_category}} main'
+    state: absent
+    filename: llvm
+    update_cache: false
+
+- name: remove old upstream deb-src repository
+  become: true
+  apt_repository:
+    repo: 'deb-src {{llvm_apt_repo_url}} {{llvm_apt_category}} main'
+    state: absent
+    filename: llvm
+    update_cache: false
+
+- name: add apt repository key
+  become: true
+  get_url:
+    url: https://apt.llvm.org/llvm-snapshot.gpg.key
+    dest: '{{keyring}}'
 
 - name: add upstream deb repository
   become: true
   apt_repository:
-    repo: 'deb {{llvm_apt_repo_url}} {{llvm_apt_category}} main'
+    repo: >
+      deb [signed-by={{keyring}}]
+      {{llvm_apt_repo_url}} {{llvm_apt_category}} main
     state: present
     filename: llvm
     update_cache: false
@@ -37,18 +70,13 @@
 - name: add upstream deb-src repository
   become: true
   apt_repository:
-    repo: 'deb-src {{llvm_apt_repo_url}} {{llvm_apt_category}} main'
+    repo: >
+      deb-src [signed-by={{keyring}}]
+      {{llvm_apt_repo_url}} {{llvm_apt_category}} main
     state: present
     filename: llvm
     update_cache: false
 
-- name: add apt repository key
-  become: true
-  apt_key:
-    url: https://apt.llvm.org/llvm-snapshot.gpg.key
-    id: 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421
-    state: present
-
 - name: update apt cache
   become: true
   apt: