diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30a29b5..5c6c58e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -334,7 +334,8 @@ jobs:
 
       - name: Install Cosign
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: sigstore/cosign-installer@v4
+        # A full version: cosign-installer publishes no major tag (no v4).
+        uses: sigstore/cosign-installer@v4.1.2
         with:
           # Match the pin in release.yml so both signing surfaces
           # (docker image here, checksums.txt in release.yml) use the
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f4b48fe..f1d089b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,7 +87,8 @@ jobs:
         uses: anchore/sbom-action/download-syft@v0
 
       - name: Install Cosign for checksum signing
-        uses: sigstore/cosign-installer@v4
+        # A full version: cosign-installer publishes no major tag (no v4).
+        uses: sigstore/cosign-installer@v4.1.2
         with:
           # Pin cosign itself, not just the installer action. The rest
           # of the supply-chain tooling pins tightly (golangci-lint
diff --git a/AGENTS.md b/AGENTS.md
index 5cc353e..56a8e9c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -295,8 +295,11 @@ CI is GitHub Actions:
 | [fuzz.yml](.github/workflows/fuzz.yml) | Nightly at 04:00 UTC: every fuzz target. |
 | [mutation.yml](.github/workflows/mutation.yml) | Weekly on Sunday at 03:00 UTC: the full gremlins run. |
 
-Actions are pinned by major version (`@v7`), and Dependabot proposes the
-bumps.
+Actions are pinned by major version (`@v7`), except
+`sigstore/cosign-installer`, which publishes no major tags and is pinned to a
+release (`@v4.1.2`); Dependabot proposes the bumps. A tag-only job is the
+first to use an action's new ref, so check that the ref exists before bumping
+one.
 
 PRs run, in this order: