diff --git a/.github/workflows/autobuild.yml b/.github/workflows/autobuild.yml
index 8a34b21..90d30a0 100644
--- a/.github/workflows/autobuild.yml
+++ b/.github/workflows/autobuild.yml
@@ -73,7 +73,7 @@ jobs:
       with:
         submodules: recursive
     - name: install cosign
-      uses: sigstore/cosign-installer@b6fc91790eda82dbba10c76a63507d45b818c83d # 3.0.4
+      uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
     - name: download artifacts
       uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4
       with:
diff --git a/.github/workflows/backbuild.yml b/.github/workflows/backbuild.yml
index 8b4e815..ad847fc 100644
--- a/.github/workflows/backbuild.yml
+++ b/.github/workflows/backbuild.yml
@@ -73,7 +73,7 @@ jobs:
       with:
         submodules: recursive
     - name: install cosign
-      uses: sigstore/cosign-installer@b6fc91790eda82dbba10c76a63507d45b818c83d # 3.0.4
+      uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
     - name: download artifacts
       uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4
       with: