diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f7c081e..5e10651 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -178,7 +178,7 @@ jobs:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: checksums-${{ github.run_id }}
-      - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+      - uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-checksums: ${{ env.CHECKSUMS_FILE }}
 
@@ -236,7 +236,7 @@ jobs:
             REVISION=${{ steps.revision.outputs.short_sha }}
       - name: Attest image provenance
         if: needs.prepare.outputs.skip_release != 'true'
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-name: ghcr.io/bare-devcontainer/decolint
           subject-digest: ${{ steps.build.outputs.digest }}