diff --git a/.github/workflows/autorelease.yml b/.github/workflows/autorelease.yml
index 3acfbae05d..d1b8211cb9 100644
--- a/.github/workflows/autorelease.yml
+++ b/.github/workflows/autorelease.yml
@@ -37,7 +37,7 @@ jobs:
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
-      - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
+      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
       - uses: anchore/sbom-action/download-syft@ab5d7b5f48981941c4c5d6bf33aeb98fe3bae38c # v0.15.10
       # ubuntu is missing wixl https://github.com/actions/virtual-environments/issues/3857
       -