diff --git a/board/build.mk b/board/build.mk
index c9c7a08c9..1796dd5c2 100644
--- a/board/build.mk
+++ b/board/build.mk
@@ -38,7 +38,7 @@ obj/gitversion.h:
 endif
 
 obj/cert.h: tools/getcertheader.py
-	./tools/getcertheader.py $(CERT) > $@
+	./tools/getcertheader.py $(CERT).pub > $@
 
 obj/bootstub.$(PROJ_NAME).o: bootstub.c early.h obj/cert.h
 	$(CC) $(CFLAGS) -o $@ -c $<
diff --git a/certs/release.pub b/certs/release.pub
new file mode 100644
index 000000000..19066e29a
--- /dev/null
+++ b/certs/release.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDGN9GU2nOc0kKq6vdZI5qUMzHt234ngqofrgCFFxL0D2Whex0zACp9gar0HZp+bvtpoSgU/Ev8wexNKr+A9QTradljiuxi5ctrOra9k+wxqNj63Wrcu4+wU5UnJEVf/buV4jCOFffMT8z3PO4imt8LzHuEIC/m/ASKVYyvuvBRQQ== batman@y840