diff --git a/apps/simplex-store-service/README.md b/apps/simplex-store-service/README.md
index f179694d73..123f66eb76 100644
--- a/apps/simplex-store-service/README.md
+++ b/apps/simplex-store-service/README.md
@@ -933,7 +933,8 @@ payment against this service in Chromium, as they run against the webapp's mock.
    age of 5 seconds;
 2. builds the names site (`vite build`) into the run's folder;
 3. writes an ini for that deployment with `[names]` and `[chain]` and no `[btcpay]` or `[stripe]`,
-   serving the names site all in one on the host `127.0.0.1`;
+   serving the names site all in one on the host `127.0.0.1`, and signing with a fixed test key
+   trusted through `[issuer] dev_keys`;
 4. starts the service once to make its database, stops it, and issues the prepaid codes the cases
    need with `//issue name` in `--run-cli`;
 5. starts the service on 8180 and a code server on 8199, and runs the cases with `BASE_URL` at the
@@ -952,11 +953,9 @@ compiled as the webapp's `dev/start.sh` needs. The cases read the chain's addres
 ```
 cabal build exe:simplex-store-service
 WEBAPP_DIR=../simplex.domains/webapp ENS_CONTRACTS_DIR=<ens-contracts> ANVIL=<anvil> \
-  ISSUER_INDEX=<index> ISSUER_SECRET=<secret> scripts/store-service/names-contract-run.sh
+  scripts/store-service/names-contract-run.sh
 ```
 
-- `ISSUER_INDEX` and `ISSUER_SECRET`: an issuer key the binary trusts, as for any start of the service
-  (see [Run](#run)).
 - `STORE_SERVICE_BIN`: the service binary (default: `cabal list-bin exe:simplex-store-service`).
 - `SERVICE_PORT`, `CODES_PORT`: the service's and the code server's ports (8180 and 8199).
 - Arguments, if given, are passed to `playwright test` in place of the default cases' title filter.
diff --git a/scripts/store-service/names-contract-run.sh b/scripts/store-service/names-contract-run.sh
index 1b1a08328b..44d8f7a0e6 100755
--- a/scripts/store-service/names-contract-run.sh
+++ b/scripts/store-service/names-contract-run.sh
@@ -8,8 +8,6 @@ shopt -s inherit_errexit
 
 : "${WEBAPP_DIR:?set WEBAPP_DIR to the names webapp (simplex.domains/webapp)}"
 : "${ENS_CONTRACTS_DIR:?set ENS_CONTRACTS_DIR to a compiled ens-contracts checkout, as for the webapp dev/start.sh}"
-: "${ISSUER_INDEX:?set ISSUER_INDEX to the index of an issuer key the service trusts}"
-: "${ISSUER_SECRET:?set ISSUER_SECRET to the secret of that key}"
 ANVIL="${ANVIL:-anvil}"
 SERVICE_PORT="${SERVICE_PORT:-8180}"
 CODES_PORT="${CODES_PORT:-8199}"
@@ -28,6 +26,10 @@ SERVICE_URL="http://127.0.0.1:$SERVICE_PORT"
 CODES_URL="http://127.0.0.1:$CODES_PORT"
 STARTUP_SECONDS=120
 CLI_TIMEOUT_SECONDS=120
+# A test issuer key, trusted through [issuer] dev_keys, which the service accepts only on chain 31337.
+# The service refuses it if a client key ever takes its index.
+DEV_ISSUER_INDEX=999
+DEV_ISSUER_SECRET=Ea5wG-J2mQjPBu9YfSJRKPnGnzoIdEE-8VaMh_wY2Bg=
 
 # The cases at webapp f53b765, run from one client, so they stay within the service's 10 code checks
 # a minute. Each takes its prepaid code from POST /control/code, which the code server below answers
@@ -102,8 +104,9 @@ names_hosts = 127.0.0.1
 trust_forwarded_for = off
 
 [issuer]
-index = $ISSUER_INDEX
-private_key = $ISSUER_SECRET
+index = $DEV_ISSUER_INDEX
+private_key = $DEV_ISSUER_SECRET
+dev_keys = $DEV_ISSUER_INDEX:$DEV_ISSUER_SECRET
 
 [names]
 tld = $(jq -r .tld "$chain")