diff --git a/buildrpms.pl b/buildrpms.pl
index 655a84b9a..2d9de0859 100755
--- a/buildrpms.pl
+++ b/buildrpms.pl
@@ -648,7 +648,6 @@ sub update_repo {
     my ($target) = @_;
     my $repodir = "dist/$target/rpms";
     index_repo($repodir);
-    write_release_alias($repodir);
 }
 
 sub write_release_alias {
@@ -783,6 +782,7 @@ sub finalize_core {
         sign_repo_dir($dir, $opts{gpg_key_name});
     }
     write_repo_metadata_dir($dir);
+    write_release_alias($dir);
     return 0;
 }
 
@@ -835,6 +835,12 @@ sub main {
         write_repo_metadata($target);
     }
 
+    # Signing regenerates repository metadata, so create the direct-download
+    # alias only after the final metadata pass.
+    for my $target ($opts{targets}->@*) {
+        write_release_alias("dist/$target/rpms");
+    }
+
     exit(0);
 }
 
diff --git a/xCAT-test/unit/xcat_release_package.t b/xCAT-test/unit/xcat_release_package.t
index a129c5144..e5f0acbdb 100644
--- a/xCAT-test/unit/xcat_release_package.t
+++ b/xCAT-test/unit/xcat_release_package.t
@@ -53,6 +53,17 @@ like(
     qr/cp \$release_rpms\[0\], \$alias/,
     'repository export creates the stable bootstrap filename'
 );
+my $sign_call = rindex($builder, 'sign_rpms($target)');
+my $alias_call = rindex($builder, 'write_release_alias("dist/$target/rpms")');
+ok(
+    $sign_call >= 0 && $alias_call > $sign_call,
+    'stable bootstrap alias is created after signed metadata is finalized'
+);
+like(
+    $builder,
+    qr/sub finalize_core \{.*?write_repo_metadata_dir\(\$dir\);.*?write_release_alias\(\$dir\);/s,
+    'assembled core repository creates the stable alias after final metadata'
+);
 
 done_testing();