diff --git a/.github/workflows/build-rechunk.yml b/.github/workflows/build-rechunk.yml
index 1cf773a..e3b1b8a 100644
--- a/.github/workflows/build-rechunk.yml
+++ b/.github/workflows/build-rechunk.yml
@@ -260,7 +260,7 @@ jobs:
 
       - name: Install Cosign
         if: ${{ steps.build_setup.outputs.push_image == 'true' }}
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Login to GHCR for cosign
         if: ${{ steps.build_setup.outputs.push_image == 'true' }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5a4422b..e3d02c9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -159,7 +159,7 @@ jobs:
           password: ${{ env.REGISTRY_PASSWORD }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
       - name: Sign container image