diff --git a/.github/workflows/release-ci.yml b/.github/workflows/release-ci.yml
index abefa72..989048e 100644
--- a/.github/workflows/release-ci.yml
+++ b/.github/workflows/release-ci.yml
@@ -191,7 +191,7 @@ jobs:
           echo "✅ SBOM generated"
       
       - name: Install Cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da  # v3.7.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad  # v4.0.0
 
       - name: Sign SBOM (keyless OIDC)
         run: |
diff --git a/.github/workflows/release-day60.yml b/.github/workflows/release-day60.yml
index cdeb3d7..9aaa7fe 100644
--- a/.github/workflows/release-day60.yml
+++ b/.github/workflows/release-day60.yml
@@ -145,7 +145,7 @@ jobs:
           name: sbom
       
       - name: Install Cosign (Apache 2.0)
-        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac  # v3
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad  # v4.0.0
       
       - name: Generate SLSA L2 Provenance (Day 60)
         run: |