diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index afc0108d2..25ca3060a 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -153,7 +153,7 @@ jobs:
       # not the mutable tag — so a future re-tag doesn't invalidate the
       # signature).
       - name: Install cosign
-        uses: sigstore/cosign-installer@v4
+        uses: sigstore/cosign-installer@v4.1.2
         with:
           cosign-release: 'v2.4.1'