diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e2fe64..4b90343 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,26 @@ versioning once its djbdns-compatible public surface stabilizes.
 
 ## [Unreleased]
 
+## [0.6.5] - 2026-09-12
+
+### Fixed
+
+- `rgbdns-data-import` now works on a DNSSEC primary. In DNSSEC mode
+  `compile-zone` only verifies the already published signed CDB, which the
+  import's private stage does not contain, so every upload failed silently
+  with status 1. The upload is now validated with the plain `tinydns-data`
+  compiler, only the `data` source is replaced, and
+  `rgbdns-dnssec-publish.service` (already started after the import) signs,
+  verifies and publishes `data.cdb`. An unsigned database is never served.
+
+### Added
+
+- `DATA_DROP_IMPORT=disabled` in `/etc/rgbdns/data-drop.env`, written by
+  `rgbdns-setup primary --data-drop-import disabled`, skips the data import
+  for primaries whose data is deployed into the state directory by other
+  means. `rgbdns-data-import.service` checks it with `ExecCondition=`, so a
+  disabled run is skipped rather than failed.
+
 ## [0.6.4] - 2026-09-12
 
 ### Fixed
diff --git a/Cargo.lock b/Cargo.lock
index e87c0ae..cbf0aff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1135,7 +1135,7 @@ checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
 [[package]]
 name = "rgbdns"
-version = "0.6.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "base64",
diff --git a/Cargo.toml b/Cargo.toml
index 1a705b9..e0b4f76 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rgbdns"
-version = "0.6.4"
+version = "0.6.5"
 edition = "2024"
 license = "Unlicense"
 description = "A safe, faithful Rust reimplementation of the djbdns suite"
diff --git a/README.md b/README.md
index 54e5265..e1892ad 100644
--- a/README.md
+++ b/README.md
@@ -172,7 +172,7 @@ On Debian or Ubuntu, build the package with:
 ```sh
 sudo apt install build-essential cargo debhelper rustc
 packaging/build-deb.sh
-sudo apt install ../rgbdns_0.6.4_$(dpkg --print-architecture).deb
+sudo apt install ../rgbdns_0.6.5_$(dpkg --print-architecture).deb
 ```
 
 On openSUSE Leap 16.0, build the RPM with:
@@ -182,7 +182,7 @@ sudo zypper --non-interactive install \
   git cargo rust python3 rpm-build systemd-rpm-macros
 packaging/build-rpm.sh
 sudo zypper --non-interactive --no-gpg-checks install \
-  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
+  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
 ```
 
 ## Book
diff --git a/debian/changelog b/debian/changelog
index c799837..4454b6e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+rgbdns (0.6.5) unstable; urgency=medium
+
+  * Import primary data uploads on DNSSEC primaries: validate with
+    tinydns-data, replace only the source and let rgbdns-dnssec-publish
+    sign and publish it. The import used to fail silently.
+  * Add DATA_DROP_IMPORT=disabled (rgbdns-setup --data-drop-import) to skip
+    the import where data is deployed into the state directory directly.
+
+ -- Alexy Khrabrov <deliverable@gmail.com>  Sat, 12 Sep 2026 23:55:25 +0200
+
 rgbdns (0.6.4) unstable; urgency=medium
 
   * Publish the newer of the source data serial and the stored ACME serial for
diff --git a/debian/rgbdns.7 b/debian/rgbdns.7
index fdd4b04..8a8717d 100644
--- a/debian/rgbdns.7
+++ b/debian/rgbdns.7
@@ -1,4 +1,4 @@
-.TH RGBDNS 7 "2026-08-18" "rgbdns 0.6.4" "System Administration"
+.TH RGBDNS 7 "2026-08-18" "rgbdns 0.6.5" "System Administration"
 .SH NAME
 rgbdns \- authoritative DNS, AXFR, recursion, and djbdns-compatible tools
 .SH SYNOPSIS
@@ -42,6 +42,9 @@ Configured scp drop path and required upload owner.
 .TP
 .I /etc/rgbdns/data-drop.env
 Configured primary-data scp drop path and required upload owner.
+.B DATA_DROP_IMPORT=disabled
+skips the import, for primaries whose data is deployed into the state
+directory directly.
 .TP
 .I /var/lib/rgbdns/tinydns/data
 Tinydns-format zone source.
diff --git a/docs/DEBIAN.md b/docs/DEBIAN.md
index e426a5d..d403d21 100644
--- a/docs/DEBIAN.md
+++ b/docs/DEBIAN.md
@@ -20,7 +20,7 @@ sudo apt install build-essential cargo debhelper rustc
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-deb.sh
-sudo apt install ../rgbdns_0.6.4_$(dpkg --print-architecture).deb
+sudo apt install ../rgbdns_0.6.5_$(dpkg --print-architecture).deb
 ```
 
 `packaging/build-deb.sh` calls `dpkg-buildpackage --build=binary --no-sign`.
@@ -132,6 +132,15 @@ replaces the live `data` and `data.cdb` only after compilation succeeds. It
 then restarts tinydns. A malformed, partial, or symlinked upload leaves the
 currently served database unchanged.
 
+On a DNSSEC primary the import validates the upload with the plain
+`tinydns-data` compiler, replaces only `data`, and leaves `data.cdb` to
+`rgbdns-dnssec-publish.service`, which signs, verifies and publishes it.
+
+A primary whose data is deployed into `/var/lib/rgbdns/tinydns` directly, for
+example by a CI workflow, can turn the import off with
+`--data-drop-import disabled`, or by adding `DATA_DROP_IMPORT=disabled` to
+`/etc/rgbdns/data-drop.env`. Uploads are then skipped, not failed.
+
 To validate before starting anything, add `--no-start`, then inspect:
 
 ```sh
@@ -258,16 +267,16 @@ sudo apt install -y build-essential cargo debhelper rustc git
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-deb.sh
-dpkg-deb --info ../rgbdns_0.6.4_amd64.deb
+dpkg-deb --info ../rgbdns_0.6.5_amd64.deb
 ```
 
 Copy the package to the EC2 host, then install it there:
 
 ```sh
-scp ../rgbdns_0.6.4_amd64.deb admin@52.10.53.234:/tmp/
+scp ../rgbdns_0.6.5_amd64.deb admin@52.10.53.234:/tmp/
 ssh admin@52.10.53.234
 sudo apt update
-sudo apt install -y /tmp/rgbdns_0.6.4_amd64.deb
+sudo apt install -y /tmp/rgbdns_0.6.5_amd64.deb
 dpkg-query -W rgbdns
 ```
 
diff --git a/docs/DNSSEC-DESIGN.md b/docs/DNSSEC-DESIGN.md
index 8ca78e5..c72cdea 100644
--- a/docs/DNSSEC-DESIGN.md
+++ b/docs/DNSSEC-DESIGN.md
@@ -1,6 +1,6 @@
 # DNSSEC design: small tools and visible state
 
-Status: implementation contract for rgbdns 0.6.4.
+Status: implementation contract for rgbdns 0.6.5.
 
 rgbdns DNSSEC follows the tinydns posture: each program does one bounded job,
 configuration is one record per line, persistent state is an ordinary file, and
@@ -152,7 +152,7 @@ they do not resolve the target independently for a signed zone.
 
 Key creation, activation, parent DS publication, rollover, revocation, and
 retirement are distinct operator actions represented by files and policy
-lines. Version 0.6.4 delivers safe single-key operation and DS derivation. A
+lines. Version 0.6.5 delivers safe single-key operation and DS derivation. A
 later feature release will add a deliberately specified multi-key rollover
 state machine; operators must not simulate rollover by silently swapping a key
 file under an unchanged policy line.
diff --git a/docs/DNSSEC.md b/docs/DNSSEC.md
index d54a58c..fe772e4 100644
--- a/docs/DNSSEC.md
+++ b/docs/DNSSEC.md
@@ -1,6 +1,6 @@
 # Optional authoritative DNSSEC
 
-rgbdns 0.6.4 adds authoritative DNSSEC as an explicit offline publication
+rgbdns 0.6.5 adds authoritative DNSSEC as an explicit offline publication
 pipeline. It is disabled by default. If `/etc/rgbdns/dnssec.env` and the
 working-directory `dnssec` policy are absent, `tinydns-data`, `tinydns`, ACME,
 ANAME, setup, and secondary synchronization follow the existing
@@ -43,7 +43,7 @@ This permits a deliberate mixed signed/unsigned CDB without making omission
 mean “unsigned.”
 
 Keep a recoverable encrypted backup of the key. Key replacement is not an
-implicit file operation: version 0.6.4 deliberately supports one active
+implicit file operation: version 0.6.5 deliberately supports one active
 combined signing key per zone and does not claim an automated multi-key
 rollover state machine.
 
diff --git a/docs/OPENSUSE.md b/docs/OPENSUSE.md
index 4c6dcb5..afda965 100644
--- a/docs/OPENSUSE.md
+++ b/docs/OPENSUSE.md
@@ -55,8 +55,8 @@ sudo zypper --non-interactive install \
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-rpm.sh
-rpm -qip dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
-rpm -qlp dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
+rpm -qip dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
+rpm -qlp dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
 ```
 
 `build-rpm.sh` creates a clean rpmbuild tree under `dist/rpmbuild`, archives
@@ -81,9 +81,9 @@ gh run download RUN_ID \
 Inspect an artifact before installation:
 
 ```sh
-rpm -K dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
-rpm -qip dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
-rpm -qlp dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
+rpm -K dist/cloud-rpm/rgbdns-0.6.5-1.x86_64.rpm
+rpm -qip dist/cloud-rpm/rgbdns-0.6.5-1.x86_64.rpm
+rpm -qlp dist/cloud-rpm/rgbdns-0.6.5-1.x86_64.rpm
 ```
 
 The development RPM is not repository-signed. `rpm -K` still verifies the
@@ -96,11 +96,11 @@ Copy a locally built package to the EC2 instance:
 
 ```sh
 scp -i ~/.ssh/KEY.pem \
-  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm \
+  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm \
   ec2-user@PUBLIC_ADDRESS:/tmp/
 ssh -i ~/.ssh/KEY.pem ec2-user@PUBLIC_ADDRESS
 sudo zypper --non-interactive --no-gpg-checks install \
-  /tmp/rgbdns-0.6.4-1.x86_64.rpm
+  /tmp/rgbdns-0.6.5-1.x86_64.rpm
 rpm -q rgbdns
 rpm -V rgbdns
 ```
diff --git a/docs/RGBDNS_SETUP.md b/docs/RGBDNS_SETUP.md
index d7da115..4c13fd1 100644
--- a/docs/RGBDNS_SETUP.md
+++ b/docs/RGBDNS_SETUP.md
@@ -1,6 +1,6 @@
 # End-to-end rgbdns setup: `fieldnotes.es`
 
-This walkthrough deploys rgbdns 0.6.4 on two AWS EC2 instances and retains
+This walkthrough deploys rgbdns 0.6.5 on two AWS EC2 instances and retains
 BuddyNS as an additional secondary network. It covers installation, initial
 role configuration, authoritative data, AXFR, atomic primary and secondary
 updates, verification, upgrades, and recovery.
@@ -118,12 +118,12 @@ gh run download "$RPM_RUN" \
   -D "$HOME/rgbdns-rpm"
 ```
 
-The 0.6.4 artifacts are:
+The 0.6.5 artifacts are:
 
 ```text
-rgbdns_0.6.4_amd64.deb
-RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
-SRPMS/rgbdns-0.6.4-1.src.rpm
+rgbdns_0.6.5_amd64.deb
+RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
+SRPMS/rgbdns-0.6.5-1.src.rpm
 ```
 
 ## 4. Install the Debian package on the primary
@@ -131,14 +131,14 @@ SRPMS/rgbdns-0.6.4-1.src.rpm
 Copy the package:
 
 ```sh
-scp "$HOME/rgbdns-deb/rgbdns_0.6.4_amd64.deb" \
+scp "$HOME/rgbdns-deb/rgbdns_0.6.5_amd64.deb" \
   bitnami@52.10.53.234:/tmp/
 ```
 
 On the primary:
 
 ```sh
-sudo apt install /tmp/rgbdns_0.6.4_amd64.deb
+sudo apt install /tmp/rgbdns_0.6.5_amd64.deb
 sudo systemctl daemon-reload
 dpkg-query -W -f='${Package} ${Version}\n' rgbdns
 getent passwd rgbdns
@@ -160,7 +160,7 @@ SUSE_USER=ec2-user
 Copy the package:
 
 ```sh
-scp "$HOME/rgbdns-rpm/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm" \
+scp "$HOME/rgbdns-rpm/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm" \
   "$SUSE_USER"@52.38.177.160:/tmp/
 ```
 
@@ -168,7 +168,7 @@ On the secondary:
 
 ```sh
 sudo zypper --non-interactive --no-gpg-checks install \
-  /tmp/rgbdns-0.6.4-1.x86_64.rpm
+  /tmp/rgbdns-0.6.5-1.x86_64.rpm
 sudo systemctl daemon-reload
 rpm -q rgbdns
 sudo rpm -V rgbdns
diff --git a/docs/conformance.md b/docs/conformance.md
index d3e172d..1f3dd2e 100644
--- a/docs/conformance.md
+++ b/docs/conformance.md
@@ -52,7 +52,7 @@ normative RFC that supplies each oracle.
 
 ## Deliberate scope boundaries
 
-The following are not claimed as implemented by rgbdns 0.6.4:
+The following are not claimed as implemented by rgbdns 0.6.5:
 
 - general-purpose dynamic UPDATE, NOTIFY, IXFR, DSO, DNS Cookies, or SIG(0);
 - TSIG algorithms other than the ACME update profile's HMAC-SHA256;
diff --git a/man/acme-materialize.1 b/man/acme-materialize.1
index 1a09071..276b2cf 100644
--- a/man/acme-materialize.1
+++ b/man/acme-materialize.1
@@ -1,4 +1,4 @@
-.TH ACME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.4" "User Commands"
+.TH ACME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 acme-materialize \- merge durable ACME DNS-01 state into tinydns source
 .SH SYNOPSIS
diff --git a/man/aname-materialize.1 b/man/aname-materialize.1
index 63ee64c..986622a 100644
--- a/man/aname-materialize.1
+++ b/man/aname-materialize.1
@@ -1,4 +1,4 @@
-.TH ANAME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.4" "User Commands"
+.TH ANAME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 aname-materialize \- replace rgbdns ANAME directives with address records
 .SH SYNOPSIS
diff --git a/man/axfr-get.1 b/man/axfr-get.1
index 3c1c34f..79958d9 100644
--- a/man/axfr-get.1
+++ b/man/axfr-get.1
@@ -1,4 +1,4 @@
-.TH AXFR-GET 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH AXFR-GET 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 axfr-get \- retrieve a DNS zone using AXFR
 .SH SYNOPSIS
diff --git a/man/axfrdns-conf.1 b/man/axfrdns-conf.1
index fe87c06..f865955 100644
--- a/man/axfrdns-conf.1
+++ b/man/axfrdns-conf.1
@@ -1,4 +1,4 @@
-.TH AXFRDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH AXFRDNS-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 axfrdns-conf \- create an axfrdns service directory
 .SH SYNOPSIS
diff --git a/man/axfrdns.1 b/man/axfrdns.1
index 0f02d9b..d619871 100644
--- a/man/axfrdns.1
+++ b/man/axfrdns.1
@@ -1,4 +1,4 @@
-.TH AXFRDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH AXFRDNS 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 axfrdns \- serve DNS zone transfers
 .SH SYNOPSIS
diff --git a/man/compile-zone.8 b/man/compile-zone.8
index 87c18cc..c4d6916 100644
--- a/man/compile-zone.8
+++ b/man/compile-zone.8
@@ -1,4 +1,4 @@
-.TH COMPILE-ZONE 8 "2026-07-23" "rgbdns 0.6.4" "System Administration"
+.TH COMPILE-ZONE 8 "2026-07-23" "rgbdns 0.6.5" "System Administration"
 .SH NAME
 compile-zone \- compile the packaged authoritative zone
 .SH SYNOPSIS
diff --git a/man/dnscache-conf.1 b/man/dnscache-conf.1
index 72b0234..b1d547c 100644
--- a/man/dnscache-conf.1
+++ b/man/dnscache-conf.1
@@ -1,4 +1,4 @@
-.TH DNSCACHE-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSCACHE-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnscache-conf \- create a dnscache service directory
 .SH SYNOPSIS
diff --git a/man/dnscache.1 b/man/dnscache.1
index 1fdb3dd..b33c9dc 100644
--- a/man/dnscache.1
+++ b/man/dnscache.1
@@ -1,4 +1,4 @@
-.TH DNSCACHE 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSCACHE 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnscache \- caching recursive DNS resolver
 .SH SYNOPSIS
diff --git a/man/dnsfilter.1 b/man/dnsfilter.1
index 98bdd6c..997fead 100644
--- a/man/dnsfilter.1
+++ b/man/dnsfilter.1
@@ -1,4 +1,4 @@
-.TH DNSFILTER 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSFILTER 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsfilter \- add reverse DNS names to input lines
 .SH SYNOPSIS
diff --git a/man/dnsip.1 b/man/dnsip.1
index 6adb185..8dabb2b 100644
--- a/man/dnsip.1
+++ b/man/dnsip.1
@@ -1,4 +1,4 @@
-.TH DNSIP 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIP 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsip \- look up IPv4 addresses
 .SH SYNOPSIS
diff --git a/man/dnsip6.1 b/man/dnsip6.1
index d428109..8426c14 100644
--- a/man/dnsip6.1
+++ b/man/dnsip6.1
@@ -1,4 +1,4 @@
-.TH DNSIP6 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIP6 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsip6 \- look up IPv6 addresses
 .SH SYNOPSIS
diff --git a/man/dnsip6q.1 b/man/dnsip6q.1
index 3547408..762f6ee 100644
--- a/man/dnsip6q.1
+++ b/man/dnsip6q.1
@@ -1,4 +1,4 @@
-.TH DNSIP6Q 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIP6Q 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsip6q \- look up and label IPv6 addresses
 .SH SYNOPSIS
diff --git a/man/dnsipq.1 b/man/dnsipq.1
index 8f4b596..ef378bd 100644
--- a/man/dnsipq.1
+++ b/man/dnsipq.1
@@ -1,4 +1,4 @@
-.TH DNSIPQ 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIPQ 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsipq \- look up and label IPv4 addresses
 .SH SYNOPSIS
diff --git a/man/dnsmx.1 b/man/dnsmx.1
index 6df8452..0b38fb7 100644
--- a/man/dnsmx.1
+++ b/man/dnsmx.1
@@ -1,4 +1,4 @@
-.TH DNSMX 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSMX 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsmx \- look up mail exchangers
 .SH SYNOPSIS
diff --git a/man/dnsname.1 b/man/dnsname.1
index 102e7be..d7f76d7 100644
--- a/man/dnsname.1
+++ b/man/dnsname.1
@@ -1,4 +1,4 @@
-.TH DNSNAME 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSNAME 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsname \- look up names for IPv4 addresses
 .SH SYNOPSIS
diff --git a/man/dnsq.1 b/man/dnsq.1
index e797970..da8c19c 100644
--- a/man/dnsq.1
+++ b/man/dnsq.1
@@ -1,4 +1,4 @@
-.TH DNSQ 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSQ 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsq \- send a non-recursive DNS query
 .SH SYNOPSIS
diff --git a/man/dnsqr.1 b/man/dnsqr.1
index 1bad214..6fabee6 100644
--- a/man/dnsqr.1
+++ b/man/dnsqr.1
@@ -1,4 +1,4 @@
-.TH DNSQR 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSQR 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsqr \- perform a recursive DNS query
 .SH SYNOPSIS
diff --git a/man/dnstrace.1 b/man/dnstrace.1
index 701a222..32ff0bf 100644
--- a/man/dnstrace.1
+++ b/man/dnstrace.1
@@ -1,4 +1,4 @@
-.TH DNSTRACE 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSTRACE 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnstrace \- trace DNS delegation
 .SH SYNOPSIS
diff --git a/man/dnstxt.1 b/man/dnstxt.1
index fdc92e1..ff6f921 100644
--- a/man/dnstxt.1
+++ b/man/dnstxt.1
@@ -1,4 +1,4 @@
-.TH DNSTXT 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSTXT 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnstxt \- look up DNS text records
 .SH SYNOPSIS
diff --git a/man/multilog.1 b/man/multilog.1
index fc6f1ee..adf1994 100644
--- a/man/multilog.1
+++ b/man/multilog.1
@@ -1,4 +1,4 @@
-.TH MULTILOG 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH MULTILOG 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 multilog \- collect and rotate service logs
 .SH SYNOPSIS
diff --git a/man/pickdns-conf.1 b/man/pickdns-conf.1
index c4c0234..ef23174 100644
--- a/man/pickdns-conf.1
+++ b/man/pickdns-conf.1
@@ -1,4 +1,4 @@
-.TH PICKDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH PICKDNS-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 pickdns-conf \- create a pickdns service directory
 .SH SYNOPSIS
diff --git a/man/pickdns-data.1 b/man/pickdns-data.1
index 1402533..6b95c4e 100644
--- a/man/pickdns-data.1
+++ b/man/pickdns-data.1
@@ -1,4 +1,4 @@
-.TH PICKDNS-DATA 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH PICKDNS-DATA 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 pickdns-data \- compile a pickdns database
 .SH SYNOPSIS
diff --git a/man/pickdns.1 b/man/pickdns.1
index 6bb489d..282eff5 100644
--- a/man/pickdns.1
+++ b/man/pickdns.1
@@ -1,4 +1,4 @@
-.TH PICKDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH PICKDNS 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 pickdns \- serve location-dependent DNS data
 .SH SYNOPSIS
diff --git a/man/random-ip.1 b/man/random-ip.1
index 4e73e6d..206554a 100644
--- a/man/random-ip.1
+++ b/man/random-ip.1
@@ -1,4 +1,4 @@
-.TH RANDOM-IP 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH RANDOM-IP 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 random-ip \- generate shuffled IPv4 addresses
 .SH SYNOPSIS
diff --git a/man/rbldns-conf.1 b/man/rbldns-conf.1
index 4669efe..4129b0c 100644
--- a/man/rbldns-conf.1
+++ b/man/rbldns-conf.1
@@ -1,4 +1,4 @@
-.TH RBLDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH RBLDNS-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rbldns-conf \- create an rbldns service directory
 .SH SYNOPSIS
diff --git a/man/rbldns-data.1 b/man/rbldns-data.1
index 39765fb..7aa7fe8 100644
--- a/man/rbldns-data.1
+++ b/man/rbldns-data.1
@@ -1,4 +1,4 @@
-.TH RBLDNS-DATA 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH RBLDNS-DATA 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rbldns-data \- compile an rbldns database
 .SH SYNOPSIS
diff --git a/man/rbldns.1 b/man/rbldns.1
index d475896..ed8ba17 100644
--- a/man/rbldns.1
+++ b/man/rbldns.1
@@ -1,4 +1,4 @@
-.TH RBLDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH RBLDNS 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rbldns \- serve a DNS block-list database
 .SH SYNOPSIS
diff --git a/man/rgbdns-acme.1 b/man/rgbdns-acme.1
index 8e145d7..e46cf6f 100644
--- a/man/rgbdns-acme.1
+++ b/man/rgbdns-acme.1
@@ -1,4 +1,4 @@
-.TH RGBDNS-ACME 1 "2026-08-18" "rgbdns 0.6.4"
+.TH RGBDNS-ACME 1 "2026-08-18" "rgbdns 0.6.5"
 .SH NAME
 rgbdns-acme \- manage ACME DNS-01 TXT state through rgbdns
 .SH SYNOPSIS
diff --git a/man/rgbdns-log-report.1 b/man/rgbdns-log-report.1
index fd17684..8e98eeb 100644
--- a/man/rgbdns-log-report.1
+++ b/man/rgbdns-log-report.1
@@ -1,4 +1,4 @@
-.TH RGBDNS-LOG-REPORT 1 "2026-08-18" "rgbdns 0.6.4"
+.TH RGBDNS-LOG-REPORT 1 "2026-08-18" "rgbdns 0.6.5"
 .SH NAME
 rgbdns-log-report \- aggregate rgbdns query logs by authoritative zone
 .SH SYNOPSIS
diff --git a/man/rgbdns-setup.8 b/man/rgbdns-setup.8
index 6a27be6..d85f47e 100644
--- a/man/rgbdns-setup.8
+++ b/man/rgbdns-setup.8
@@ -1,4 +1,4 @@
-.TH RGBDNS-SETUP 8 "2026-07-26" "rgbdns 0.6.4" "System Administration"
+.TH RGBDNS-SETUP 8 "2026-07-26" "rgbdns 0.6.5" "System Administration"
 .SH NAME
 rgbdns-setup \- configure a packaged rgbdns primary or secondary
 .SH SYNOPSIS
@@ -51,6 +51,15 @@ Enable offline authoritative DNSSEC on a primary using the absolute policy
 file. If omitted, setup preserves the ordinary djbdns-compatible unsigned
 publication path.
 .TP
+.BI --data-drop-import " mode"
+.B enabled
+(default) or
+.BR disabled .
+A disabled primary skips uploads to the data drop; use it when the data is
+deployed into
+.I /var/lib/rgbdns/tinydns
+by other means.
+.TP
 .B --no-start
 Write configuration without enabling or starting services.
 .SH SEE ALSO
diff --git a/man/rgbsec-check.1 b/man/rgbsec-check.1
index 78db9de..473d5c3 100644
--- a/man/rgbsec-check.1
+++ b/man/rgbsec-check.1
@@ -1,4 +1,4 @@
-.TH RGBSEC-CHECK 1 "2026-08-19" "rgbdns 0.6.4" "User Commands"
+.TH RGBSEC-CHECK 1 "2026-08-19" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rgbsec-check \- verify an rgbdns signed snapshot and signature lifetime
 .SH SYNOPSIS
diff --git a/man/rgbsec-data.1 b/man/rgbsec-data.1
index b6b77cf..de9cdd0 100644
--- a/man/rgbsec-data.1
+++ b/man/rgbsec-data.1
@@ -1,4 +1,4 @@
-.TH RGBSEC-DATA 1 "2026-08-19" "rgbdns 0.6.4" "User Commands"
+.TH RGBSEC-DATA 1 "2026-08-19" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rgbsec-data \- sign and compile an rgbdns DNSSEC snapshot
 .SH SYNOPSIS
diff --git a/man/rgbsec-ds.1 b/man/rgbsec-ds.1
index 2a366bd..ceae1cd 100644
--- a/man/rgbsec-ds.1
+++ b/man/rgbsec-ds.1
@@ -1,4 +1,4 @@
-.TH RGBSEC-DS 1 "2026-08-19" "rgbdns 0.6.4" "User Commands"
+.TH RGBSEC-DS 1 "2026-08-19" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rgbsec-ds \- derive the parent DS record from an rgbdns DNSSEC policy
 .SH SYNOPSIS
diff --git a/man/rgbsec-keygen.1 b/man/rgbsec-keygen.1
index dd6cff0..0501ec2 100644
--- a/man/rgbsec-keygen.1
+++ b/man/rgbsec-keygen.1
@@ -1,4 +1,4 @@
-.TH RGBSEC-KEYGEN 1 "2026-08-19" "rgbdns 0.6.4" "User Commands"
+.TH RGBSEC-KEYGEN 1 "2026-08-19" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rgbsec-keygen \- create an rgbdns DNSSEC signing key and policy line
 .SH SYNOPSIS
diff --git a/man/rgbsec-sign.1 b/man/rgbsec-sign.1
index 232619a..8ddf6de 100644
--- a/man/rgbsec-sign.1
+++ b/man/rgbsec-sign.1
@@ -1,4 +1,4 @@
-.TH RGBSEC-SIGN 1 "2026-08-19" "rgbdns 0.6.4" "User Commands"
+.TH RGBSEC-SIGN 1 "2026-08-19" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 rgbsec-sign \- sign tinydns source as an offline DNSSEC snapshot
 .SH SYNOPSIS
diff --git a/man/secondary-sync.8 b/man/secondary-sync.8
index e1fddc4..5a2b217 100644
--- a/man/secondary-sync.8
+++ b/man/secondary-sync.8
@@ -1,4 +1,4 @@
-.TH SECONDARY-SYNC 8 "2026-07-23" "rgbdns 0.6.4" "System Administration"
+.TH SECONDARY-SYNC 8 "2026-07-23" "rgbdns 0.6.5" "System Administration"
 .SH NAME
 secondary-sync \- refresh the packaged secondary zone
 .SH SYNOPSIS
diff --git a/man/setuidgid.1 b/man/setuidgid.1
index 1b8b9a7..31e71ae 100644
--- a/man/setuidgid.1
+++ b/man/setuidgid.1
@@ -1,4 +1,4 @@
-.TH SETUIDGID 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH SETUIDGID 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 setuidgid \- run a program with another account's identity
 .SH SYNOPSIS
diff --git a/man/tai64n.1 b/man/tai64n.1
index 34e60cc..4c622bf 100644
--- a/man/tai64n.1
+++ b/man/tai64n.1
@@ -1,4 +1,4 @@
-.TH TAI64N 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TAI64N 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tai64n \- prefix lines with precise timestamps
 .SH SYNOPSIS
diff --git a/man/tai64nlocal.1 b/man/tai64nlocal.1
index 7aa9f9f..425fc7d 100644
--- a/man/tai64nlocal.1
+++ b/man/tai64nlocal.1
@@ -1,4 +1,4 @@
-.TH TAI64NLOCAL 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TAI64NLOCAL 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tai64nlocal \- convert TAI64N timestamps to local time
 .SH SYNOPSIS
diff --git a/man/tinydns-conf.1 b/man/tinydns-conf.1
index 28bf545..b79c510 100644
--- a/man/tinydns-conf.1
+++ b/man/tinydns-conf.1
@@ -1,4 +1,4 @@
-.TH TINYDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TINYDNS-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tinydns-conf \- create a tinydns service directory
 .SH SYNOPSIS
diff --git a/man/tinydns-data.1 b/man/tinydns-data.1
index 7d5a9c4..30286b6 100644
--- a/man/tinydns-data.1
+++ b/man/tinydns-data.1
@@ -1,4 +1,4 @@
-.TH TINYDNS-DATA 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TINYDNS-DATA 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tinydns-data \- compile a tinydns zone database
 .SH SYNOPSIS
diff --git a/man/tinydns-edit.1 b/man/tinydns-edit.1
index f3113c7..2a89434 100644
--- a/man/tinydns-edit.1
+++ b/man/tinydns-edit.1
@@ -1,4 +1,4 @@
-.TH TINYDNS-EDIT 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TINYDNS-EDIT 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tinydns-edit \- add a record to tinydns source data
 .SH SYNOPSIS
diff --git a/man/tinydns-get.1 b/man/tinydns-get.1
index 8973aa1..99f80d3 100644
--- a/man/tinydns-get.1
+++ b/man/tinydns-get.1
@@ -1,4 +1,4 @@
-.TH TINYDNS-GET 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TINYDNS-GET 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tinydns-get \- inspect an answer from tinydns source data
 .SH SYNOPSIS
diff --git a/man/tinydns.1 b/man/tinydns.1
index 2d57c5d..e048036 100644
--- a/man/tinydns.1
+++ b/man/tinydns.1
@@ -1,4 +1,4 @@
-.TH TINYDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH TINYDNS 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 tinydns \- authoritative DNS server
 .SH SYNOPSIS
diff --git a/man/walldns-conf.1 b/man/walldns-conf.1
index 9737704..e31aea4 100644
--- a/man/walldns-conf.1
+++ b/man/walldns-conf.1
@@ -1,4 +1,4 @@
-.TH WALLDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH WALLDNS-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 walldns-conf \- create a walldns service directory
 .SH SYNOPSIS
diff --git a/man/walldns.1 b/man/walldns.1
index bde5ced..5a46952 100644
--- a/man/walldns.1
+++ b/man/walldns.1
@@ -1,4 +1,4 @@
-.TH WALLDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH WALLDNS 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 walldns \- provide generic reverse DNS answers
 .SH SYNOPSIS
diff --git a/packaging/rpm/rgbdns.spec b/packaging/rpm/rgbdns.spec
index aca5ecd..84c9a92 100644
--- a/packaging/rpm/rgbdns.spec
+++ b/packaging/rpm/rgbdns.spec
@@ -1,5 +1,5 @@
 Name:           rgbdns
-Version:        0.6.4
+Version:        0.6.5
 Release:        1%{?dist}
 Summary:        Memory-safe DNS server and djbdns-compatible tool suite
 License:        Unlicense
@@ -171,6 +171,9 @@ fi
 %{_mandir}/man1/rgbsec-sign.1%{?ext_man}
 
 %changelog
+* Sat Sep 12 2026 Alexy Khrabrov <deliverable@gmail.com> - 0.6.5-1
+- Import primary data uploads on DNSSEC primaries; add DATA_DROP_IMPORT
+
 * Sat Sep 12 2026 Alexy Khrabrov <deliverable@gmail.com> - 0.6.4-1
 - Publish the newer of the source and stored ACME serials
 
diff --git a/packaging/scripts/import-data b/packaging/scripts/import-data
index 99f2dd6..71e3dbe 100755
--- a/packaging/scripts/import-data
+++ b/packaging/scripts/import-data
@@ -1,11 +1,56 @@
 #!/bin/sh
 set -eu
 
+# rgbdns-data-import.service: validate an uploaded primary data file and make
+# it live.
+#
+#   import-data                   import $DATA_DROP (see /etc/rgbdns/data-drop.env)
+#   import-data --check-enabled   ExecCondition: exit 0 when the import is
+#                                 enabled, 1 to skip the run cleanly when
+#                                 DATA_DROP_IMPORT=disabled, 255 (a unit
+#                                 failure) for any other value
+#
+# Without DNSSEC the staged upload is compiled with compile-zone and both data
+# and data.cdb are replaced. On a DNSSEC primary (/etc/rgbdns/dnssec.env)
+# compile-zone only verifies the already signed CDB, so the upload is instead
+# validated with the plain tinydns-data compiler and only data is replaced;
+# rgbdns-dnssec-publish.service, started after this script, signs, verifies
+# and publishes data.cdb from it. An unsigned validation database is never
+# served.
+
+import_mode() {
+    case ${DATA_DROP_IMPORT:-enabled} in
+        enabled) return 0 ;;
+        disabled) return 1 ;;
+        *)
+            echo "rgbdns-import-data: DATA_DROP_IMPORT must be enabled or disabled, not: $DATA_DROP_IMPORT" >&2
+            exit 255
+            ;;
+    esac
+}
+
+case ${1-} in
+    --check-enabled)
+        import_mode && exit 0
+        echo "rgbdns-import-data: skipped: DATA_DROP_IMPORT=disabled"
+        exit 1
+        ;;
+    '') ;;
+    *) echo "usage: import-data [--check-enabled]" >&2; exit 2 ;;
+esac
+
+import_mode || {
+    echo "rgbdns-import-data: DATA_DROP_IMPORT=disabled; nothing imported"
+    exit 0
+}
+
 : "${DATA_DROP:?DATA_DROP is required in /etc/rgbdns/data-drop.env}"
 : "${DATA_DROP_OWNER:?DATA_DROP_OWNER is required in /etc/rgbdns/data-drop.env}"
 
 state_dir=${RGBDNS_STATE_DIR:-/var/lib/rgbdns/tinydns}
 compile_zone=${RGBDNS_COMPILE_ZONE:-/usr/lib/rgbdns/compile-zone}
+dnssec_env=${RGBDNS_DNSSEC_ENV:-/etc/rgbdns/dnssec.env}
+tinydns_data=${RGBDNS_TINYDNS_DATA:-/usr/bin/tinydns-data}
 service_user=${RGBDNS_SERVICE_USER-rgbdns}
 
 exec 9>"$state_dir/acme-update.lock"
@@ -36,6 +81,26 @@ umask 027
 install -m 0640 "$DATA_DROP" "$stage/data"
 if [ -n "$service_user" ]; then
     chown "$service_user:$service_user" "$stage" "$stage/data"
+fi
+
+if [ -r "$dnssec_env" ]; then
+    # Validation only: the compiled database stays in the stage and is removed.
+    if [ -n "$service_user" ]; then
+        # shellcheck disable=SC2016 # $1 and $2 expand in the child shell
+        runuser -u "$service_user" -- sh -c 'cd "$1" && exec "$2"' sh "$stage" "$tinydns_data"
+    else
+        (cd "$stage" && "$tinydns_data")
+    fi
+    [ -s "$stage/data.cdb" ] || {
+        echo "rgbdns-import-data: validation produced no data.cdb" >&2
+        exit 1
+    }
+    mv -f "$stage/data" "$state_dir/data"
+    echo "rgbdns-import-data: validated $DATA_DROP and installed it as the DNSSEC source; rgbdns-dnssec-publish.service signs and publishes it"
+    exit 0
+fi
+
+if [ -n "$service_user" ]; then
     runuser -u "$service_user" -- env RGBDNS_STATE_DIR="$stage" "$compile_zone"
 else
     RGBDNS_STATE_DIR=$stage "$compile_zone"
diff --git a/packaging/scripts/rgbdns-setup b/packaging/scripts/rgbdns-setup
index b8bf087..12d59b9 100755
--- a/packaging/scripts/rgbdns-setup
+++ b/packaging/scripts/rgbdns-setup
@@ -17,6 +17,8 @@ options:
   --dnssec-policy FILE      apply one explicit K (signed) or U (unsigned) line per zone
   --data-drop FILE          watch an scp destination for primary rgbdns.data
   --data-drop-owner USER    require data uploads to be owned by USER
+  --data-drop-import MODE   enabled (default) or disabled, for primaries whose
+                            data is deployed into the state directory directly
   --zone NAME               add a zone to transfer (repeatable)
   --zones "NAME ..."        add a whitespace- or comma-separated zone list
   --zones-drop FILE         watch an scp destination for a one-zone-per-line list
@@ -65,6 +67,7 @@ query_log=1
 data_file=
 data_drop=
 data_drop_owner=${SUDO_USER:-root}
+data_drop_import=enabled
 zones=
 primary=
 zones_drop=
@@ -77,7 +80,7 @@ while [ $# -gt 0 ]; do
     option=$1
     shift
     case $option in
-        --listen-ip|--port|--allow-nets|--query-log|--acme-update-config|--dnssec-policy|--data|--data-drop|--data-drop-owner|--zone|--zones|--primary|--zones-drop|--zones-drop-owner)
+        --listen-ip|--port|--allow-nets|--query-log|--acme-update-config|--dnssec-policy|--data|--data-drop|--data-drop-owner|--data-drop-import|--zone|--zones|--primary|--zones-drop|--zones-drop-owner)
             [ $# -gt 0 ] || die "$option requires a value"
             value=$1
             shift
@@ -91,6 +94,7 @@ while [ $# -gt 0 ]; do
                 --data) data_file=$value ;;
                 --data-drop) data_drop=$value ;;
                 --data-drop-owner) data_drop_owner=$value ;;
+                --data-drop-import) data_drop_import=$value ;;
                 --zone) zones="${zones}${zones:+ }$value" ;;
                 --zones)
                     value=$(printf '%s' "$value" | tr ',' ' ')
@@ -147,6 +151,10 @@ case $data_drop in
 esac
 getent passwd "$data_drop_owner" >/dev/null 2>&1 ||
     die "data drop owner does not exist: $data_drop_owner"
+case $data_drop_import in
+    enabled|disabled) ;;
+    *) die "data drop import must be enabled or disabled: $data_drop_import" ;;
+esac
 
 if [ -z "$zones_drop" ]; then
     zones_drop=/var/lib/rgbdns/incoming/rgbdns.zones
@@ -219,7 +227,8 @@ case $role in
             /etc/rgbdns/zones-drop.env
         rm -rf /etc/systemd/system/rgbdns-zones.path.d
         write_env /etc/rgbdns/data-drop.env \
-            "DATA_DROP=$data_drop" "DATA_DROP_OWNER=$data_drop_owner"
+            "DATA_DROP=$data_drop" "DATA_DROP_OWNER=$data_drop_owner" \
+            "DATA_DROP_IMPORT=$data_drop_import"
         install -d -m 0755 /etc/systemd/system/rgbdns-data.path.d
         {
             printf '%s\n' '[Path]' 'PathChanged='
diff --git a/packaging/systemd/rgbdns-data-import.service b/packaging/systemd/rgbdns-data-import.service
index 5d4a834..6072945 100644
--- a/packaging/systemd/rgbdns-data-import.service
+++ b/packaging/systemd/rgbdns-data-import.service
@@ -8,6 +8,8 @@ Type=oneshot
 User=root
 Group=root
 EnvironmentFile=/etc/rgbdns/data-drop.env
+# DATA_DROP_IMPORT=disabled in data-drop.env skips the run (not a failure).
+ExecCondition=/usr/lib/rgbdns/import-data --check-enabled
 ExecStart=/usr/lib/rgbdns/import-data
 ExecStartPost=/bin/systemctl start rgbdns-dnssec-publish.service
 ExecStartPost=/bin/systemctl try-restart rgbdns-tinydns.service
diff --git a/packaging/tests/test-import-data.sh b/packaging/tests/test-import-data.sh
index 4017b0c..a74ad0e 100755
--- a/packaging/tests/test-import-data.sh
+++ b/packaging/tests/test-import-data.sh
@@ -7,21 +7,32 @@ mkdir -p "$test_dir/state" "$test_dir/bin"
 drop=$test_dir/rgbdns.data
 owner=$(id -un)
 
-cat >"$test_dir/bin/compile-zone" <<'EOF'
+# Keep the test independent of the host's /etc/rgbdns.
+RGBDNS_DNSSEC_ENV=$test_dir/absent-dnssec.env
+RGBDNS_SERVICE_USER=
+export RGBDNS_DNSSEC_ENV RGBDNS_SERVICE_USER
+unset DATA_DROP_IMPORT 2>/dev/null || true
+
+fail() {
+    echo "test-import-data: $*" >&2
+    exit 1
+}
+
+cat >"$test_dir/bin/compile-zone" <<'STUB'
 #!/bin/sh
 if grep -q '^INVALID$' "$RGBDNS_STATE_DIR/data"; then
     exit 1
 fi
 cp "$RGBDNS_STATE_DIR/data" "$RGBDNS_STATE_DIR/data.cdb"
-EOF
+STUB
 chmod +x "$test_dir/bin/compile-zone"
 
+# --- Unsigned primary: compile-zone output replaces data and data.cdb.
 printf '.example.net:192.0.2.1:a\n' >"$drop"
 DATA_DROP=$drop \
 DATA_DROP_OWNER=$owner \
 RGBDNS_STATE_DIR=$test_dir/state \
 RGBDNS_COMPILE_ZONE=$test_dir/bin/compile-zone \
-RGBDNS_SERVICE_USER='' \
     packaging/scripts/import-data
 test "$(cat "$test_dir/state/data")" = '.example.net:192.0.2.1:a'
 test "$(cat "$test_dir/state/data.cdb")" = '.example.net:192.0.2.1:a'
@@ -31,11 +42,9 @@ if DATA_DROP=$drop \
     DATA_DROP_OWNER=$owner \
     RGBDNS_STATE_DIR=$test_dir/state \
     RGBDNS_COMPILE_ZONE=$test_dir/bin/compile-zone \
-    RGBDNS_SERVICE_USER='' \
         packaging/scripts/import-data
 then
-    echo "test-import-data: invalid data unexpectedly succeeded" >&2
-    exit 1
+    fail "invalid data unexpectedly succeeded"
 fi
 test "$(cat "$test_dir/state/data")" = '.example.net:192.0.2.1:a'
 test "$(cat "$test_dir/state/data.cdb")" = '.example.net:192.0.2.1:a'
@@ -46,11 +55,85 @@ if DATA_DROP=$drop \
     DATA_DROP_OWNER=$owner \
     RGBDNS_STATE_DIR=$test_dir/state \
     RGBDNS_COMPILE_ZONE=$test_dir/bin/compile-zone \
-    RGBDNS_SERVICE_USER='' \
         packaging/scripts/import-data
 then
-    echo "test-import-data: symlink unexpectedly succeeded" >&2
-    exit 1
+    fail "symlink unexpectedly succeeded"
+fi
+rm -f "$drop"
+
+# --- DNSSEC primary: compile-zone only verifies the signed CDB, so it must not
+# be used; the upload is validated with tinydns-data in the stage, only data is
+# replaced, and the published signed data.cdb is left for rgbdns-dnssec-publish.
+cat >"$test_dir/bin/compile-zone-verify-only" <<'STUB'
+#!/bin/sh
+echo "compile-zone must not validate uploads on a DNSSEC primary" >&2
+exit 99
+STUB
+cat >"$test_dir/bin/tinydns-data" <<'STUB'
+#!/bin/sh
+test -r data || exit 111
+if grep -q '^INVALID$' data; then
+    exit 111
 fi
+cp data data.cdb
+STUB
+chmod +x "$test_dir/bin/compile-zone-verify-only" "$test_dir/bin/tinydns-data"
+: >"$test_dir/dnssec.env"
+signed=$test_dir/signed
+mkdir -p "$signed"
+printf '.example.net:192.0.2.1:a\n' >"$signed/data"
+printf 'SIGNED\n' >"$signed/data.cdb"
+
+import_signed() {
+    DATA_DROP=$drop \
+    DATA_DROP_OWNER=$owner \
+    RGBDNS_STATE_DIR=$signed \
+    RGBDNS_COMPILE_ZONE=$test_dir/bin/compile-zone-verify-only \
+    RGBDNS_DNSSEC_ENV=$test_dir/dnssec.env \
+    RGBDNS_TINYDNS_DATA=$test_dir/bin/tinydns-data \
+        packaging/scripts/import-data
+}
+
+printf '.example.net:192.0.2.2:a\n' >"$drop"
+import_signed || fail "valid upload failed on a DNSSEC primary"
+test "$(cat "$signed/data")" = '.example.net:192.0.2.2:a' ||
+    fail "DNSSEC source was not replaced"
+test "$(cat "$signed/data.cdb")" = 'SIGNED' ||
+    fail "an unsigned database replaced the signed data.cdb"
+# No find(1) here: the openSUSE build container does not ship findutils.
+for leftover in "$signed"/.primary-import.*; do
+    [ ! -e "$leftover" ] || fail "stage left behind: $leftover"
+done
+
+printf 'INVALID\n' >"$drop"
+if import_signed; then
+    fail "invalid upload unexpectedly succeeded on a DNSSEC primary"
+fi
+test "$(cat "$signed/data")" = '.example.net:192.0.2.2:a' ||
+    fail "invalid DNSSEC upload replaced the source"
+test "$(cat "$signed/data.cdb")" = 'SIGNED'
+
+# --- DATA_DROP_IMPORT flag (ExecCondition and direct runs).
+check_enabled() {
+    set +e
+    env "$@" packaging/scripts/import-data --check-enabled >/dev/null 2>&1
+    status=$?
+    set -e
+    echo "$status"
+}
+[ "$(check_enabled DATA_DROP_IMPORT=)" = 0 ] || fail "empty flag should enable"
+[ "$(check_enabled DATA_DROP_IMPORT=enabled)" = 0 ] || fail "enabled should enable"
+[ "$(check_enabled DATA_DROP_IMPORT=disabled)" = 1 ] || fail "disabled should skip with 1"
+[ "$(check_enabled DATA_DROP_IMPORT=bogus)" = 255 ] || fail "invalid flag should fail with 255"
+
+printf '.example.net:192.0.2.3:a\n' >"$drop"
+DATA_DROP_IMPORT=disabled \
+DATA_DROP=$drop \
+DATA_DROP_OWNER=$owner \
+RGBDNS_STATE_DIR=$test_dir/state \
+RGBDNS_COMPILE_ZONE=$test_dir/bin/compile-zone \
+    packaging/scripts/import-data >/dev/null || fail "disabled direct run should exit 0"
+test "$(cat "$test_dir/state/data")" = '.example.net:192.0.2.1:a' ||
+    fail "disabled import changed the state"
 
 echo "test-import-data: passed"