diff --git a/.github/workflows/attest-release.yml b/.github/workflows/attest-release.yml
index aa59a57..0a3a4e9 100644
--- a/.github/workflows/attest-release.yml
+++ b/.github/workflows/attest-release.yml
@@ -21,7 +21,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be  # v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
         with:
           subject-path: |
             cloakbrowser-*.tar.gz
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 061b530..dfc894d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -129,7 +129,7 @@ jobs:
       - name: Sign image
         run: cosign sign --yes cloakhq/cloakbrowser@${{ steps.build.outputs.digest }}
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be  # v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
         with:
           subject-name: index.docker.io/cloakhq/cloakbrowser
           subject-digest: ${{ steps.build.outputs.digest }}