diff --git a/Makefile b/Makefile
index 2d4125dde..039b41e0a 100644
--- a/Makefile
+++ b/Makefile
@@ -62,7 +62,7 @@ update_padded_macs: ## update padded MAC information
 	cd $(MACSDIR); ./update-macs.sh
 
 update_root_key_file: ## update root key file
-	${DOCKER_COMPOSE_TOOLS_CMD} run --rm tools /opt/unbound/sbin/unbound-anchor -a $(DNSDIR)/root.key
+	${DOCKER_COMPOSE_TOOLS_CMD} run --rm tools bin/update_dnssec_root_key.sh $(DNSDIR)/root.key
 
 # create some shorthands
 env ?=
diff --git a/bin/update_dnssec_root_key.sh b/bin/update_dnssec_root_key.sh
new file mode 100755
index 000000000..68ecd23d7
--- /dev/null
+++ b/bin/update_dnssec_root_key.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env sh
+set -u
+
+if [ $# -eq 0 ]; then
+  >&2 echo "Please provide an argument: The root anchor key file, that is read in and written out."
+  exit 1
+fi
+
+/opt/unbound/sbin/unbound-anchor -a "$1"
+# The following sed rules do:
+# s/ *;;.*//g				remove all metadata comments
+# s/^(.\t)[0-9]+\t/\1/g		remove all TTLs
+# /^$/d						delete empty lines
+sed -ri 's/ *;;.*//g;s/^(.\t)[0-9]+\t/\1/g;/^$/d' "$1"
+# use C to have binary order and reverse to put ; above .
+LC_ALL=C sort -ro "$1" "$1"
diff --git a/docker/compose.build.yaml b/docker/compose.build.yaml
index 088e8834e..0f99659ca 100644
--- a/docker/compose.build.yaml
+++ b/docker/compose.build.yaml
@@ -40,6 +40,15 @@ services:
         # required because current version of nassl cannot be compile for ARM (eg: Apple Silicon)
         - "linux/amd64"
 
+  worker-scheduler:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+      target: app
+      platforms:
+        # required because current version of nassl cannot be compile for ARM (eg: Apple Silicon)
+        - "linux/amd64"
+
   worker-slow:
     build:
       context: ..
diff --git a/remote_data/dns/root.key b/remote_data/dns/root.key
index e304ef39c..e951ec70d 100644
--- a/remote_data/dns/root.key
+++ b/remote_data/dns/root.key
@@ -1,10 +1,3 @@
 ; autotrust trust anchor file
-;;id: . 1
-;;last_queried: 1784020545 ;;Tue Jul 14 09:15:45 2026
-;;last_success: 1784020545 ;;Tue Jul 14 09:15:45 2026
-;;next_probe_time: 1784059916 ;;Tue Jul 14 20:11:56 2026
-;;query_failed: 0
-;;query_interval: 43200
-;;retry_time: 8640
-.	86400	IN	DNSKEY	257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1776426131 ;;Fri Apr 17 11:42:11 2026
-.	172800	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1519657238 ;;Mon Feb 26 15:00:38 2018
+.	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
+.	IN	DNSKEY	257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b}