diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml
index 482d78f..c174eb8 100644
--- a/.github/workflows/chart.yml
+++ b/.github/workflows/chart.yml
@@ -61,7 +61,18 @@ jobs:
           echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
           echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
 
-      - name: Log in to Container Registry
+      # Two credential stores need populating: docker/login-action writes
+      # ~/.docker/config.json (read by cosign when it pushes the signature),
+      # while helm push uses Helm's own registry config. Authenticating only
+      # one leaves the other UNAUTHORIZED.
+      - name: Log in to Container Registry (cosign)
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Helm registry
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" \
             | helm registry login "${REGISTRY}" --username "${{ github.actor }}" --password-stdin
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ccb3618..4d6518c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -141,6 +141,7 @@ jobs:
             type=semver,pattern={{major}}
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -153,14 +154,21 @@ jobs:
           build-args: |
             VERSION=${{ needs.release.outputs.version }}
 
-      - name: Sign container image
+      - name: Install cosign
         uses: sigstore/cosign-installer@v3
 
-      - name: Sign the images with cosign
-        run: |
-          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release.outputs.version }}
+      - name: Lowercase image reference
+        id: img
+        # github.repository is mixed-case (AYDEV-FR/dploy); OCI refs must be
+        # lowercase or cosign rejects them with "could not parse reference".
+        run: echo "name=${IMAGE_NAME,,}" >> "$GITHUB_OUTPUT"
         env:
-          COSIGN_EXPERIMENTAL: 1
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+
+      - name: Sign the image with cosign
+        # Sign the immutable digest from the build, not the mutable tag.
+        run: |
+          cosign sign --yes "${REGISTRY}/${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}"
 
   update-docs:
     name: Update Documentation