diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e6a22b..980a729 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Checksums
         working-directory: dist
         run: sha256sum kaasu-* kaasu.spdx.json > SHA256SUMS
-      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: Sign
         working-directory: dist
         run: |