diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2c1ea9d..aea9517 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -158,7 +158,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           # v2.x — v3 broke our sign-blob flag compatibility.
           cosign-release: 'v2.6.3'