diff --git a/tool/depot/mk/downloader b/tool/depot/mk/downloader
index 99816e895..5db9e5bc2 100755
--- a/tool/depot/mk/downloader
+++ b/tool/depot/mk/downloader
@@ -41,8 +41,8 @@ include $(GENODE_DIR)/tool/depot/mk/gpg.inc
 
 $(DEPOT_DIR)/% : $(PUBLIC_DIR)/%.tar.xz $(PUBLIC_DIR)/%.tar.xz.sig
 	$(VERBOSE)pubkey_file=$(DEPOT_DIR)/$(call archive_user,$*)/pubkey; \
-	          gpg --yes -o $$pubkey_file.dearmored --dearmor $$pubkey_file; \
-	          ( gpg --no-tty --no-default-keyring \
+	          $(GPG) --yes -o $$pubkey_file.dearmored --dearmor $$pubkey_file; \
+	          ( $(GPG) --no-tty --no-default-keyring \
 	                --keyring $$pubkey_file.dearmored \
 	                --verify $(PUBLIC_DIR)/$*.tar.xz.sig 2> /dev/null; retval=$$?; \
 	            rm -f $$pubkey_file.dearmored; \
diff --git a/tool/depot/mk/gpg.inc b/tool/depot/mk/gpg.inc
index e78ac11ea..9c76c9e28 100644
--- a/tool/depot/mk/gpg.inc
+++ b/tool/depot/mk/gpg.inc
@@ -4,11 +4,14 @@
 # \date   2017-03-27
 #
 
+# Allow the gpg command to be overridden on the command line
+GPG ?= gpg
+
 pubkey_filename = $(call archive_user,$1)/pubkey
 pubkey_path     = $(wildcard $(DEPOT_DIR)/$(call pubkey_filename,$1))
 
 # obtain key ID of 'depot/<user>/pubkey' to be used to select signing key
-pubkey_id = $(shell gpg --with-colon < $(call pubkey_path,$1) | head -1 | cut -d: -f5 )
+pubkey_id = $(shell $(GPG) --with-colon < $(call pubkey_path,$1) | head -1 | cut -d: -f5 )
 
 MISSING_PUBKEY_FILES := $(sort \
                            $(foreach A,$(ARCHIVES),\
@@ -19,6 +22,3 @@ missing_pubkey_files:
 	@echo "Error: missing public-key files:";\
 	 for i in $(MISSING_PUBKEY_FILES); do echo "       $$i"; done; false
 
-# Allow the gpg command to be overridden on the command line
-GPG ?= gpg
-