diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ae7cdb5..3b3b730 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -280,7 +280,7 @@ jobs:
         # Sign only on TAGGED release builds. We don't sign every main push —
         # signatures are a release artifact; signing dev images is noise.
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       # Keyless sign the image BY DIGEST. COSIGN_EXPERIMENTAL/--yes drive the
       # OIDC keyless flow: cosign requests a token from GitHub's OIDC provider