--- a/pkg/plugins/manager/signature/manifest.go
+++ b/pkg/plugins/manager/signature/manifest.go
@@ -198,10 +198,19 @@
 		}
 	}
 
+	backend, distributorVerified, err := s.distributorBackend(ctx, src, plugin, manifest)
+	if err != nil {
+		s.log.Warn("Distributor backend binding invalid", "id", plugin.JSONData.ID, "error", err)
+		return plugins.Signature{Status: plugins.SignatureStatusModified}, nil
+	}
+
 	manifestFiles := make(map[string]struct{}, len(manifest.Files))
 
 	// Verify the manifest contents
 	for p, hash := range manifest.Files {
+		if distributorVerified && p == backend.Binary {
+			hash = backend.RebuiltSHA
+		}
 		err = verifyHash(s.log, plugin, p, hash)
 		if err != nil {
 			s.log.Debug("Plugin signature invalid", "pluginId", plugin.JSONData.ID, "error", err)
@@ -239,6 +248,14 @@
 		}, nil
 	}
 
+	if distributorVerified {
+		s.log.Info("Distributor backend verified; upstream signed assets verified", "id", plugin.JSONData.ID, "backendSHA256", backend.RebuiltSHA)
+		return plugins.Signature{
+			Status: plugins.SignatureStatusDistributorVerified,
+			SigningOrg: "The Peoples (rebuilt backend); " + manifest.SignedByOrgName + " (upstream signed assets)",
+		}, nil
+	}
+
 	s.log.Debug("Plugin signature valid", "id", plugin.JSONData.ID)
 	return plugins.Signature{
 		Status:     plugins.SignatureStatusValid,
--- a/pkg/plugins/manager/signature/signature.go
+++ b/pkg/plugins/manager/signature/signature.go
@@ -26,7 +26,7 @@
 }
 
 func (s *Validation) ValidateSignature(plugin *plugins.Plugin) error {
-	if plugin.Signature.IsValid() {
+	if plugin.Signature.IsValid() || plugin.Signature == plugins.SignatureStatusDistributorVerified {
 		s.log.Debug("Plugin has valid signature", "id", plugin.ID)
 		return nil
 	}
--- a/pkg/plugins/models.go
+++ b/pkg/plugins/models.go
@@ -227,6 +227,9 @@
 }
 
 const (
+	// DistributorVerified authenticates rebuilt bundled backends through the image build policy.
+	// It does not claim that the replacement executable has an upstream plugin signature.
+	SignatureStatusDistributorVerified SignatureStatus = "distributor-verified"
 	SignatureStatusInternal SignatureStatus = "internal" // core plugin, no signature
 	SignatureStatusValid    SignatureStatus = "valid"    // signed and accurate MANIFEST
 	SignatureStatusInvalid  SignatureStatus = "invalid"  // invalid signature