diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c96f1ff..6fbda7b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -145,7 +145,7 @@ jobs:
         run: python tests/release_smoke.py
 
       - name: Attest the exact built artifacts
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: dist/*
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f10fee2..f6264e3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -103,7 +103,7 @@ jobs:
       - name: Sign checksums
         run: cosign sign-blob release/checksums.txt --bundle release/checksums.txt.sigstore.json --yes
       - name: Attest release binaries and Python distributions
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: |
             release/headerproof-*
@@ -172,7 +172,7 @@ jobs:
         run: cosign sign --yes "$IMAGE@$DIGEST"
       - name: Attest container provenance
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.build.outputs.digest }}