diff --git a/.github/workflows/packages.yaml b/.github/workflows/packages.yaml
index ca0ff9b..f8ae89c 100644
--- a/.github/workflows/packages.yaml
+++ b/.github/workflows/packages.yaml
@@ -172,7 +172,7 @@ jobs:
       # rather than a hijacked tag or a compromised maintainer machine.
       # See: https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
           subject-digest: ${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/releases.yaml b/.github/workflows/releases.yaml
index 514c014..5f3d65d 100644
--- a/.github/workflows/releases.yaml
+++ b/.github/workflows/releases.yaml
@@ -210,7 +210,7 @@ jobs:
       # release or a compromised maintainer machine.
       # See: https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: ${{ env.ARCHIVE_NAME }}