diff --git a/.devcontainer/README.md b/.devcontainer/README.md
index 2b0d05d0f3..36ab112ab2 100644
--- a/.devcontainer/README.md
+++ b/.devcontainer/README.md
@@ -107,7 +107,8 @@ entry in the container's local keyring (to select the key) and the forwarded age
    ```
 
 3. Rebuild the container. The `postStartCommand` auto-imports `.git/signing.pub`
-   and removes it.
+   on every container start, so signing survives restarts and rebuilds without
+   re-running the export script.
 
 The helper auto-selects `gpg2`/`gpg` based on where your key is visible, which
 avoids host setups where the two binaries use different keyrings.
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 2aac5eb426..6c61d55fdf 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -56,7 +56,7 @@
 
   "postCreateCommand": "pnpm install --frozen-lockfile",
 
-  "postStartCommand": "if [ -f .git/signing.pub ]; then gpg --import .git/signing.pub && rm .git/signing.pub; fi",
+  "postStartCommand": "if [ -f .git/signing.pub ]; then gpg --import .git/signing.pub; fi",
 
   "runArgs": ["--cap-drop=ALL", "--security-opt=no-new-privileges:true", "--pids-limit=512"]
 }
diff --git a/docs/dev-containers.md b/docs/dev-containers.md
index 674d8a52cb..68a94841e7 100644
--- a/docs/dev-containers.md
+++ b/docs/dev-containers.md
@@ -94,7 +94,8 @@ This is the one-time host-side setup:
 	```
 
 3. Rebuild the container. The `postStartCommand` auto-imports `.git/signing.pub`
-   and removes it.
+   on every container start, so signing survives restarts and rebuilds without
+   re-running the export script.
 
 Then verify inside the container: