diff --git a/CHANGES b/CHANGES
index 9a002f5fc8..631629d7a4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3976.	[bug]		When refreshing managed-key trust anchors, clear
+			any cached trust so that they will always be
+			revalidated with the current set of secure
+			roots. [RT #37506]
+
 3974.	[bug]		handle DH_compute_key() failure correctly in
 			openssldh_link.c. [RT #37477]
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index e2cac62d86..af58755fc5 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8270,6 +8270,12 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 		goto done;
 	}
 
+	/*
+	 * Clear any cached trust level, as we need to run validation
+	 * over again; trusted keys might have changed.
+	 */
+	kfetch->dnskeyset.trust = kfetch->dnskeysigset.trust = dns_trust_none;
+
 	/*
 	 * Validate the dnskeyset against the current trusted keys.
 	 */
@@ -8303,7 +8309,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 				dns_zone_log(zone, ISC_LOG_DEBUG(3),
 					     "Verifying DNSKEY set for zone "
-					     "'%s': %s", namebuf,
+					     "'%s' using key %d/%d: %s",
+					     namebuf, sig.keyid, sig.algorithm,
 					     dns_result_totext(result));
 
 				if (result == ISC_R_SUCCESS) {