diff --git a/Dockerfile.updater b/Dockerfile.updater
index ade40cb..444ff44 100644
--- a/Dockerfile.updater
+++ b/Dockerfile.updater
@@ -6,7 +6,7 @@ COPY updater/go.mod ./
 COPY updater/main.go ./
 RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /netkeep-updater .
 
-FROM ghcr.io/sigstore/cosign/cosign:v3.0.6@sha256:de9c65609e6bde17e6b48de485ee788407c9502fa08b8f4459f595b21f56cd00 AS cosign
+FROM ghcr.io/sigstore/cosign/cosign:v3.1.3@sha256:9e5c2f2edc34351160407ca3416c61855bdf9403c3c5936e0f0be7fc261611b8 AS cosign
 
 FROM docker:29.6.2-cli-alpine3.24@sha256:be132a9f282288de4afaf63379dff75711fda0147c6b72a9df44e51841402144
 RUN rm -f /usr/local/libexec/docker/cli-plugins/docker-buildx