diff --git a/.github/workflows/deposit.yml b/.github/workflows/deposit.yml
index 02d6347..f45ad15 100644
--- a/.github/workflows/deposit.yml
+++ b/.github/workflows/deposit.yml
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install oras
         uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1 as of 2026-08-07
diff --git a/.github/workflows/say-line-status.yml b/.github/workflows/say-line-status.yml
index d93c037..b227041 100644
--- a/.github/workflows/say-line-status.yml
+++ b/.github/workflows/say-line-status.yml
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install oras
         uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1