diff --git a/internal/database/database.go b/internal/database/database.go
index fc313aa7f..367d717a0 100644
--- a/internal/database/database.go
+++ b/internal/database/database.go
@@ -179,3 +179,7 @@ func (db *DB) Organizations() *OrganizationsStore {
 func (db *DB) Permissions() *PermissionsStore {
 	return newPermissionsStore(db.db)
 }
+
+func (db *DB) PublicKey() *PublicKeysStore {
+	return newPublicKeysStore(db.db)
+}
diff --git a/internal/database/public_keys.go b/internal/database/public_keys.go
index 3856bd353..8bdbd16a6 100644
--- a/internal/database/public_keys.go
+++ b/internal/database/public_keys.go
@@ -15,32 +15,22 @@ import (
 	"gogs.io/gogs/internal/osutil"
 )
 
-// PublicKeysStore is the persistent interface for public keys.
-type PublicKeysStore interface {
-	// RewriteAuthorizedKeys rewrites the "authorized_keys" file under the SSH root
-	// path with all public keys stored in the database.
-	RewriteAuthorizedKeys() error
+// PublicKeysStore is the storage layer for public keys.
+type PublicKeysStore struct {
+	db *gorm.DB
 }
 
-var PublicKeys PublicKeysStore
-
-var _ PublicKeysStore = (*publicKeysStore)(nil)
-
-type publicKeysStore struct {
-	*gorm.DB
-}
-
-// NewPublicKeysStore returns a persistent interface for public keys with given
-// database connection.
-func NewPublicKeysStore(db *gorm.DB) PublicKeysStore {
-	return &publicKeysStore{DB: db}
+func newPublicKeysStore(db *gorm.DB) *PublicKeysStore {
+	return &PublicKeysStore{db: db}
 }
 
 func authorizedKeysPath() string {
 	return filepath.Join(conf.SSH.RootPath, "authorized_keys")
 }
 
-func (s *publicKeysStore) RewriteAuthorizedKeys() error {
+// RewriteAuthorizedKeys rewrites the "authorized_keys" file under the SSH root
+// path with all public keys stored in the database.
+func (s *PublicKeysStore) RewriteAuthorizedKeys() error {
 	sshOpLocker.Lock()
 	defer sshOpLocker.Unlock()
 
@@ -61,7 +51,7 @@ func (s *publicKeysStore) RewriteAuthorizedKeys() error {
 
 	// NOTE: More recently updated keys are more likely to be used more frequently,
 	// putting them in the earlier lines could speed up the key lookup by SSHD.
-	rows, err := s.Model(&PublicKey{}).Order("updated_unix DESC").Rows()
+	rows, err := s.db.Model(&PublicKey{}).Order("updated_unix DESC").Rows()
 	if err != nil {
 		return errors.Wrap(err, "iterate public keys")
 	}
@@ -69,7 +59,7 @@ func (s *publicKeysStore) RewriteAuthorizedKeys() error {
 
 	for rows.Next() {
 		var key PublicKey
-		err = s.ScanRows(rows, &key)
+		err = s.db.ScanRows(rows, &key)
 		if err != nil {
 			return errors.Wrap(err, "scan rows")
 		}
diff --git a/internal/database/public_keys_test.go b/internal/database/public_keys_test.go
index 9a361be81..b710cd50a 100644
--- a/internal/database/public_keys_test.go
+++ b/internal/database/public_keys_test.go
@@ -24,22 +24,22 @@ func TestPublicKeys(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
-	db := &publicKeysStore{
-		DB: newTestDB(t, "publicKeysStore"),
+	s := &PublicKeysStore{
+		db: newTestDB(t, "PublicKeysStore"),
 	}
 
 	for _, tc := range []struct {
 		name string
-		test func(t *testing.T, ctx context.Context, db *publicKeysStore)
+		test func(t *testing.T, ctx context.Context, s *PublicKeysStore)
 	}{
 		{"RewriteAuthorizedKeys", publicKeysRewriteAuthorizedKeys},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Cleanup(func() {
-				err := clearTables(t, db.DB)
+				err := clearTables(t, s.db)
 				require.NoError(t, err)
 			})
-			tc.test(t, ctx, db)
+			tc.test(t, ctx, s)
 		})
 		if t.Failed() {
 			break
@@ -47,7 +47,7 @@ func TestPublicKeys(t *testing.T) {
 	}
 }
 
-func publicKeysRewriteAuthorizedKeys(t *testing.T, ctx context.Context, db *publicKeysStore) {
+func publicKeysRewriteAuthorizedKeys(t *testing.T, ctx context.Context, s *PublicKeysStore) {
 	// TODO: Use PublicKeys.Add to replace SQL hack when the method is available.
 	publicKey := &PublicKey{
 		OwnerID:     1,
@@ -55,11 +55,11 @@ func publicKeysRewriteAuthorizedKeys(t *testing.T, ctx context.Context, db *publ
 		Fingerprint: "12:f8:7e:78:61:b4:bf:e2:de:24:15:96:4e:d4:72:53",
 		Content:     "test-key-content",
 	}
-	err := db.DB.Create(publicKey).Error
+	err := s.db.Create(publicKey).Error
 	require.NoError(t, err)
 	tempSSHRootPath := filepath.Join(os.TempDir(), "publicKeysRewriteAuthorizedKeys-tempSSHRootPath")
 	conf.SetMockSSH(t, conf.SSHOpts{RootPath: tempSSHRootPath})
-	err = db.RewriteAuthorizedKeys()
+	err = s.RewriteAuthorizedKeys()
 	require.NoError(t, err)
 
 	authorizedKeys, err := os.ReadFile(authorizedKeysPath())
diff --git a/internal/database/users.go b/internal/database/users.go
index a6ebc4f6a..018caa93a 100644
--- a/internal/database/users.go
+++ b/internal/database/users.go
@@ -645,7 +645,7 @@ func (s *usersStore) DeleteByID(ctx context.Context, userID int64, skipRewriteAu
 	_ = os.Remove(userutil.CustomAvatarPath(userID))
 
 	if needsRewriteAuthorizedKeys {
-		err = NewPublicKeysStore(s.DB).RewriteAuthorizedKeys()
+		err = newPublicKeysStore(s.DB).RewriteAuthorizedKeys()
 		if err != nil {
 			return errors.Wrap(err, `rewrite "authorized_keys" file`)
 		}
@@ -672,7 +672,7 @@ func (s *usersStore) DeleteInactivated() error {
 			return errors.Wrapf(err, "delete user with ID %d", userID)
 		}
 	}
-	err = NewPublicKeysStore(s.DB).RewriteAuthorizedKeys()
+	err = newPublicKeysStore(s.DB).RewriteAuthorizedKeys()
 	if err != nil {
 		return errors.Wrap(err, `rewrite "authorized_keys" file`)
 	}
diff --git a/internal/database/users_test.go b/internal/database/users_test.go
index 4e511279c..f4231f090 100644
--- a/internal/database/users_test.go
+++ b/internal/database/users_test.go
@@ -534,7 +534,7 @@ func usersDeleteByID(t *testing.T, ctx context.Context, db *usersStore) {
 	require.NoError(t, err)
 	tempSSHRootPath := filepath.Join(os.TempDir(), "usersDeleteByID-tempSSHRootPath")
 	conf.SetMockSSH(t, conf.SSHOpts{RootPath: tempSSHRootPath})
-	err = NewPublicKeysStore(db.DB).RewriteAuthorizedKeys()
+	err = newPublicKeysStore(db.DB).RewriteAuthorizedKeys()
 	require.NoError(t, err)
 
 	// Mock issue assignee