diff --git a/cmd/cosign/cli/attach/attach.go b/cmd/cosign/cli/attach/attach.go
index 9b645422add..dcd3a290f4c 100644
--- a/cmd/cosign/cli/attach/attach.go
+++ b/cmd/cosign/cli/attach/attach.go
@@ -51,6 +51,7 @@ func attachAttestation(ctx context.Context, remoteOpts []ociremote.Option, signe
 	if err != nil {
 		return err
 	}
+	defer attestationFile.Close()
 
 	env := ssldsse.Envelope{}
 	decoder := json.NewDecoder(attestationFile)