diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 584ad4277..4b4f2e387 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+      - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
diff --git a/.github/workflows/kind-cluster-image-policy-no-tuf.yaml b/.github/workflows/kind-cluster-image-policy-no-tuf.yaml
index f78787bdd..76fdce8bb 100644
--- a/.github/workflows/kind-cluster-image-policy-no-tuf.yaml
+++ b/.github/workflows/kind-cluster-image-policy-no-tuf.yaml
@@ -112,7 +112,7 @@ jobs:
       with:
         mirror: mirror.gcr.io
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Install cluster + sigstore
       uses: sigstore/scaffolding/actions/setup@main
diff --git a/.github/workflows/kind-cluster-image-policy-resync-period.yaml b/.github/workflows/kind-cluster-image-policy-resync-period.yaml
index cab5a0ae5..1778eda1a 100644
--- a/.github/workflows/kind-cluster-image-policy-resync-period.yaml
+++ b/.github/workflows/kind-cluster-image-policy-resync-period.yaml
@@ -112,7 +112,7 @@ jobs:
       with:
         mirror: mirror.gcr.io
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Install cluster + sigstore
       uses: sigstore/scaffolding/actions/setup@main
diff --git a/.github/workflows/kind-cluster-image-policy-trustroot.yaml b/.github/workflows/kind-cluster-image-policy-trustroot.yaml
index c6f3cba49..e4aa3ede6 100644
--- a/.github/workflows/kind-cluster-image-policy-trustroot.yaml
+++ b/.github/workflows/kind-cluster-image-policy-trustroot.yaml
@@ -117,7 +117,7 @@ jobs:
       with:
         mirror: mirror.gcr.io
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Install cluster + sigstore
       uses: sigstore/scaffolding/actions/setup@main
diff --git a/.github/workflows/kind-cluster-image-policy-tsa.yaml b/.github/workflows/kind-cluster-image-policy-tsa.yaml
index 34268ae30..9aad4afd7 100644
--- a/.github/workflows/kind-cluster-image-policy-tsa.yaml
+++ b/.github/workflows/kind-cluster-image-policy-tsa.yaml
@@ -112,7 +112,7 @@ jobs:
       with:
         mirror: mirror.gcr.io
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v2
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v2
 
     - name: Install cluster + sigstore
       uses: sigstore/scaffolding/actions/setup@main
diff --git a/.github/workflows/kind-cluster-image-policy.yaml b/.github/workflows/kind-cluster-image-policy.yaml
index 3c9da1fa6..5dcd21ca3 100644
--- a/.github/workflows/kind-cluster-image-policy.yaml
+++ b/.github/workflows/kind-cluster-image-policy.yaml
@@ -126,7 +126,7 @@ jobs:
       with:
         mirror: mirror.gcr.io
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Install cluster + sigstore
       uses: sigstore/scaffolding/actions/setup@main
diff --git a/.github/workflows/kind-e2e-cosigned.yaml b/.github/workflows/kind-e2e-cosigned.yaml
index d148ba6e5..ef9b874d2 100644
--- a/.github/workflows/kind-e2e-cosigned.yaml
+++ b/.github/workflows/kind-e2e-cosigned.yaml
@@ -105,7 +105,7 @@ jobs:
     - name: Install yq
       uses: mikefarah/yq@1c3d55106075bd37df197b4bc03cb4a413fdb903 # v4.40.4
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Setup mirror
       uses: chainguard-dev/actions/setup-mirror@main
diff --git a/.github/workflows/kind-e2e-trustroot-crd.yaml b/.github/workflows/kind-e2e-trustroot-crd.yaml
index 5100ef112..92ddab11d 100644
--- a/.github/workflows/kind-e2e-trustroot-crd.yaml
+++ b/.github/workflows/kind-e2e-trustroot-crd.yaml
@@ -105,7 +105,7 @@ jobs:
     - name: Install yq
       uses: mikefarah/yq@1c3d55106075bd37df197b4bc03cb4a413fdb903 # v4.40.4
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Setup mirror
       uses: chainguard-dev/actions/setup-mirror@main
diff --git a/.github/workflows/policy-tester-examples.yml b/.github/workflows/policy-tester-examples.yml
index de4ec2747..c46a37097 100644
--- a/.github/workflows/policy-tester-examples.yml
+++ b/.github/workflows/policy-tester-examples.yml
@@ -49,7 +49,7 @@ jobs:
       run: |
         make policy-tester
 
-    - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+    - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
     - name: Setup local registry
       run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0384b0380..b5674e65e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -26,7 +26,7 @@ jobs:
           go-version-file: './go.mod'
           check-latest: true
 
-      - uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8
+      - uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149
 
       - uses: anchore/sbom-action/download-syft@5ecf649a417b8ae17dc8383dc32d46c03f2312df # v0.15.1