diff --git a/Dockerfile.updater b/Dockerfile.updater
index ade40cb..796383f 100644
--- a/Dockerfile.updater
+++ b/Dockerfile.updater
@@ -6,7 +6,7 @@ COPY updater/go.mod ./
 COPY updater/main.go ./
 RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /netkeep-updater .
 
-FROM ghcr.io/sigstore/cosign/cosign:v3.0.6@sha256:de9c65609e6bde17e6b48de485ee788407c9502fa08b8f4459f595b21f56cd00 AS cosign
+FROM ghcr.io/sigstore/cosign/cosign:v3.1.2@sha256:d91bc4e7e95e8d2f549c747a72dc174f90579e410a1695f57f686674f84ce849 AS cosign
 
 FROM docker:29.6.2-cli-alpine3.24@sha256:be132a9f282288de4afaf63379dff75711fda0147c6b72a9df44e51841402144
 RUN rm -f /usr/local/libexec/docker/cli-plugins/docker-buildx