diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b9c342..5cdfe1a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,6 +25,8 @@ jobs:
       
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v2.5.2
       
       - name: Install syft
         run: |
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 63c2c4f..95890ff 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -62,11 +62,10 @@ signs:
     signature: '${artifact}.sig'
     args:
       - sign-blob
-      - '--yes'
-      - '--new-bundle-format=false'
       - '--output-certificate=${certificate}'
       - '--output-signature=${signature}'
       - '${artifact}'
+      - '--yes'
     artifacts: checksum
     output: true