diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index 0c7dbbb..53502bc 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -211,7 +211,7 @@ jobs:
       # future bumps are deliberate rather than mechanical.
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 (cosign v3.0.5)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.1 (cosign v3.0.5)
 
       # Sign the GHCR image we just pushed. cosign sign --yes skips the
       # interactive Y/N prompt that would otherwise hang in CI.
diff --git a/.github/workflows/oss-release.yml b/.github/workflows/oss-release.yml
index 7716418..51866fb 100644
--- a/.github/workflows/oss-release.yml
+++ b/.github/workflows/oss-release.yml
@@ -145,7 +145,7 @@ jobs:
       # verification regex in docs/admin/build-info.md trusts both
       # workflow identities.
       - name: Install cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 (cosign v3.0.5)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.1 (cosign v3.0.5)
       - name: Sign release image (keyless)
         run: |
           cosign sign --yes \