diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml
index 7ec01df..b7f2062 100644
--- a/.github/workflows/release-beta.yml
+++ b/.github/workflows/release-beta.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Build deterministic archives
         run: go run ./scripts/release --version "$GITHUB_REF_NAME" --out dist
       - name: Attest release files
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: |
             dist/*.tar.gz
diff --git a/oss_release_test.go b/oss_release_test.go
index a7f147b..5ac7cce 100644
--- a/oss_release_test.go
+++ b/oss_release_test.go
@@ -45,7 +45,7 @@ func TestBetaReleaseWorkflowContract(t *testing.T) {
 		"id-token: write",
 		"go test -race -count=3 ./...",
 		"go run ./scripts/release",
-		"actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d",
+		"actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6",
 		"dist/checksums.txt",
 		"dist/release-receipt.json",
 		"--prerelease",