diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
index 333cf705dd..b4b6510255 100644
--- a/.github/workflows/image.yaml
+++ b/.github/workflows/image.yaml
@@ -19,7 +19,7 @@ jobs:
         with:
           go-version: 1.18
           check-latest: true
-      - uses: sigstore/cosign-installer@v2.8.1
+      - uses: sigstore/cosign-installer@v3.0.1
 
       # Build ko from HEAD, build and push an image tagged with the commit SHA,
       # then keylessly sign it with cosign.
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index 3f0696db73..b838d9bee1 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -35,7 +35,7 @@ jobs:
         registry-authority: ${{ env.REGISTRY_NAME }}:${{ env.REGISTRY_PORT }}
 
     - name: Install Cosign
-      uses: sigstore/cosign-installer@v2.8.1
+      uses: sigstore/cosign-installer@v3.0.1
       with:
         cosign-release: 'v1.7.2'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 393465320e..56e667269c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
           go-version: 1.18
           check-latest: true
       - uses: imjasonh/setup-ko@v0.6 # This installs the current latest release.
-      - uses: sigstore/cosign-installer@v2.8.1
+      - uses: sigstore/cosign-installer@v3.0.1
       - run: |
           tag=$(echo ${{ github.ref }} | cut -c11-) # get tag name without tags/refs/ prefix.
           img=$(ko build --bare --platform=all -t latest -t ${{ github.sha }} -t ${tag} ./)
diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 6f0a98e71c..f135abb030 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -21,7 +21,7 @@ jobs:
           go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
-      - uses: sigstore/cosign-installer@v2.8.1
+      - uses: sigstore/cosign-installer@v3.0.1
       - uses: actions/checkout@v3
 
       - name: Install CycloneDX
@@ -53,7 +53,7 @@ jobs:
           go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
-      - uses: sigstore/cosign-installer@v2.8.1
+      - uses: sigstore/cosign-installer@v3.0.1
       - uses: actions/checkout@v3
 
       - name: Install SPDX Tools
@@ -85,7 +85,7 @@ jobs:
           go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
-      - uses: sigstore/cosign-installer@v2.8.1
+      - uses: sigstore/cosign-installer@v3.0.1
       - uses: actions/checkout@v3
 
       - name: Install SPDX Tools