diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml
index dd4c4109ac..d97324e8a4 100644
--- a/.github/workflows/image.yaml
+++ b/.github/workflows/image.yaml
@@ -19,7 +19,7 @@ jobs:
         with:
           go-version: 1.17
           check-latest: true
-      - uses: sigstore/cosign-installer@v2.4.1
+      - uses: sigstore/cosign-installer@v2.5.0
 
       # Build ko from HEAD, build and push an image tagged with the commit SHA,
       # then keylessly sign it with cosign.
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index 45dc5e185c..e48c67d567 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -35,7 +35,7 @@ jobs:
         registry-authority: ${{ env.REGISTRY_NAME }}:${{ env.REGISTRY_PORT }}
 
     - name: Install Cosign
-      uses: sigstore/cosign-installer@v2.4.1
+      uses: sigstore/cosign-installer@v2.5.0
       with:
         cosign-release: 'v1.7.2'
 
diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 633432c3c2..2c347ea4ec 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -112,7 +112,7 @@ jobs:
           unzip tools-java-1.0.4.zip
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v2.4.0
+        uses: sigstore/cosign-installer@v2.5.0
         with:
           cosign-release: 'v1.7.2'