diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7089750..140d5d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -559,7 +559,7 @@ jobs:
       - name: Attest build provenance (best-effort on PR CI)
         id: attest_prov
         continue-on-error: true
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-checksums: dist/provenance/subjects-attest.sha256
       - name: Finalize + consumer-style verify
diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml
index 1ac73bb..963d4e6 100644
--- a/.github/workflows/release-provenance.yml
+++ b/.github/workflows/release-provenance.yml
@@ -122,7 +122,7 @@ jobs:
       - name: Attest build provenance (immutable subjects)
         id: attest_prov
         continue-on-error: true
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-checksums: dist/provenance/subjects-attest.sha256
 
@@ -173,7 +173,7 @@ jobs:
         id: attest_binding
         if: ${{ steps.finalize.outputs.status == 'signed' }}
         continue-on-error: true
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: dist/provenance/ReleaseProvenanceBinding.v0.json
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8773bb0..d59c90d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -463,7 +463,7 @@ jobs:
       - name: Attest build provenance (immutable subjects)
         id: attest_prov
         continue-on-error: true
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-checksums: dist/provenance/subjects-attest.sha256
 
@@ -519,7 +519,7 @@ jobs:
       - name: Attest sealed provenance binding
         if: ${{ steps.finalize_prov.outputs.status == 'signed' }}
         continue-on-error: true
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: dist/provenance/ReleaseProvenanceBinding.v0.json