diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2d82eee..97a0ea0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -68,7 +68,7 @@ jobs:
         with:
           go-version: "1.25"
           cache-dependency-path: src/go.sum
-      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
       # syft powers GoReleaser's SBOM generation.
       - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
       # `go install` needs a tag named after the module's subdirectory: the