diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b55e07e8..081cd878 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -2284,7 +2284,7 @@ jobs:
         run: bash .github/tests/test-app-recovery.sh
 
       - name: ✍️ Install Cosign for disposable cryptographic publication tests
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
       - name: 📦 Install Flux for native recovery tagging
         uses: fluxcd/flux2/action@3fa784edd773d56630bb9f62645e08f70c2cff0a # v2.10.0
diff --git a/.github/workflows/publish-app.yaml b/.github/workflows/publish-app.yaml
index 10a6cece..44681a05 100644
--- a/.github/workflows/publish-app.yaml
+++ b/.github/workflows/publish-app.yaml
@@ -235,7 +235,7 @@ jobs:
         uses: fluxcd/flux2/action@3fa784edd773d56630bb9f62645e08f70c2cff0a # v2.10.0
 
       - name: ✍️ Setup Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
       - name: 🔐 Log in to registry
         uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
diff --git a/.github/workflows/publish-manifests.yaml b/.github/workflows/publish-manifests.yaml
index ce6ed490..414a24b7 100644
--- a/.github/workflows/publish-manifests.yaml
+++ b/.github/workflows/publish-manifests.yaml
@@ -186,7 +186,7 @@ jobs:
         uses: fluxcd/flux2/action@3fa784edd773d56630bb9f62645e08f70c2cff0a # v2.10.0
 
       - name: ✍️ Setup Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
       - name: 🔒 Reserve publisher helper checkout
         run: |