diff --git a/usr.sbin/pkg/pkg.c b/usr.sbin/pkg/pkg.c
--- a/usr.sbin/pkg/pkg.c
+++ b/usr.sbin/pkg/pkg.c
@@ -889,7 +889,7 @@
 		    getenv("TMPDIR") ? getenv("TMPDIR") : _PATH_TMP,
 		    bootstrap_name);
 		snprintf(url, MAXPATHLEN, "%s/Latest/%s.pubkeysig",
-		    repo->url, bootstrap_name);
+		    packagesite, bootstrap_name);
 
 		if ((fd_sig = fetch_to_fd(repo, url, tmpsig, fetchOpts)) == -1) {
 			fprintf(stderr, "Signature for pkg not "