diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4fbaa2d..e9347a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,7 +74,7 @@ jobs:
         uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
       - if: steps.release-please.outputs.releases_created == 'true'
         name: Setup Cosign CLI
-        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       # release-please already created the release with its notes; goreleaser's
       # default release mode (keep-existing) only uploads the artifacts to it.
       - if: steps.release-please.outputs.releases_created == 'true'