diff --git a/prune-registry.sh b/prune-registry.sh
index 862fbe5..2821973 100755
--- a/prune-registry.sh
+++ b/prune-registry.sh
@@ -18,7 +18,8 @@ REGISTRY_HOST="${REGISTRY_HOST:-$(printf '%s' "${GITEA_URL}" | sed -E 's#https?:
 TOKEN="${REGISTRY_TOKEN:?REGISTRY_TOKEN (write:package) is required}"
 AUTHFILE="${AUTHFILE:-${HOME}/.docker/config.json}"
 API="${GITEA_URL%/}/api/v1/packages/${OWNER}/container/${IMAGE}"
-IMAGE_REF="${REGISTRY_HOST}/${OWNER}/${IMAGE}"
+# Registry paths are lowercase (the Gitea API owner is not).
+IMAGE_REF="${REGISTRY_HOST}/$(printf '%s' "${OWNER}" | tr '[:upper:]' '[:lower:]')/${IMAGE}"
 
 # Collect all versions (paginated).
 versions=""
@@ -41,13 +42,24 @@ for d in "${DISTROS[@]}"; do
   [[ -n "${newest}" ]] && keep["${newest}"]=1
 done
 
-# Keep the cosign signature of each kept image tag.
+# Keep the cosign signature of each kept image tag. If no digest could be
+# resolved, keep every signature tag rather than risk deleting a needed one.
+resolved=0
 for tag in "${!keep[@]}"; do
   [[ "${tag}" == sha256-* ]] && continue
   digest="$(skopeo inspect --authfile "${AUTHFILE}" --format '{{.Digest}}' \
     "docker://${IMAGE_REF}:${tag}" 2>/dev/null || true)"
-  [[ -n "${digest}" ]] && keep["sha256-${digest#sha256:}.sig"]=1
+  if [[ -n "${digest}" ]]; then
+    keep["sha256-${digest#sha256:}.sig"]=1
+    resolved=1
+  fi
 done
+if [[ "${resolved}" -eq 0 ]]; then
+  echo "WARNING: could not resolve any image digest; keeping all signature tags"
+  while IFS= read -r v; do
+    [[ "${v}" == sha256-* ]] && keep["${v}"]=1
+  done <<< "${versions}"
+fi
 
 # Delete everything else.
 while IFS= read -r v; do