diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e4a491..6a41a08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -129,6 +129,8 @@ record. Each later release appends a new section at the top.
 
 ### Fixed
 
+- **The README's cosign floor said 3, and 2.5 verifies a release** — the old floor turned
+  away working installs.
 - **Bump `kaish-kernel` to 0.14.1** — the explorer's shell no longer drops piped or
   buffered stdin across `read`/`grep`/`cat`, and a loop or `if` that exits early keeps
   what it already printed.
diff --git a/README.md b/README.md
index 3a6b2e6..362479d 100644
--- a/README.md
+++ b/README.md
@@ -143,10 +143,12 @@ against any file from the release:
 gh attestation verify kaibo-v0.2.0-x86_64-unknown-linux-musl.tar.gz -R tobert/kaibo
 ```
 
-With [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) ≥ 3
+With [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) ≥ 2.5
 (no GitHub tooling needed), verify the signed checksum manifest once and it
-covers every file it lists. Grab `checksums.txt` and `checksums.txt.sigstore.json`
-from the release, substituting the tag you downloaded in the identity:
+covers every file it lists. 2.4 and older cannot read the bundle format and
+answer `bundle does not contain cert for verification`. Grab `checksums.txt` and
+`checksums.txt.sigstore.json` from the release, substituting the tag you
+downloaded in the identity:
 
 ```sh
 cosign verify-blob \