diff --git a/.github/workflows/build-push.yaml b/.github/workflows/build-push.yaml
index 44bbf3b..63dd5c2 100644
--- a/.github/workflows/build-push.yaml
+++ b/.github/workflows/build-push.yaml
@@ -628,6 +628,8 @@ jobs:
       - name: Install Cosign
         if: inputs.sign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v3.1.3 # renovate: datasource=github-releases depName=sigstore/cosign
 
       - name: Install checksum-verified Syft
         if: inputs.sign
diff --git a/renovate.json5 b/renovate.json5
index 4339bf3..7a8e62f 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -3,5 +3,17 @@
   extends: [
     'github>libops/renovate-config:default.json5',
   ],
+  customManagers: [
+    {
+      customType: 'regex',
+      description: 'Update the Cosign release installed by the reusable image publisher',
+      managerFilePatterns: [
+        '/^\.github/workflows/build-push\.yaml$/',
+      ],
+      matchStrings: [
+        'cosign-release:\\s*(?<currentValue>\\S+)\\s+# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>\\S+)',
+      ],
+      versioningTemplate: 'semver-coerced',
+    },
+  ],
 }
-