diff --git a/.github/workflows/images.yaml b/.github/workflows/images.yaml
index 487324325d..da26f846f1 100644
--- a/.github/workflows/images.yaml
+++ b/.github/workflows/images.yaml
@@ -91,7 +91,7 @@ jobs:
 
     # Sign images if not a PR.
     - if: github.event_name != 'pull_request'
-      uses: sigstore/cosign-installer@b3413d484cc23cf8778c3d2aa361568d4eb54679 # v2.5.1
+      uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v2.5.1
       with:
         cosign-release: 'v1.11.1'
     - if: github.event_name != 'pull_request'