diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5cba6bc..85a954c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -151,7 +151,7 @@ jobs:
 
       # Signed provenance: what built these archives, from which commit, with which workflow.
       # Verifiable with `gh attestation verify <file> --repo isndev/qev`.
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/*.tar.gz