diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 68fdb37..1dfddc1 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -30,6 +30,11 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.21'
+      -
+        name: install cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.13.1'
       -
         uses: anchore/sbom-action/download-syft@v0.15.8
       -