diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2dc611e..f9b76e0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -132,7 +132,7 @@ jobs:
           PUBKEY_FILE: ${{ vars.RELEASE_PUBKEY_FILE }}
         run: go run ./tools/release-sign -verify dist/SHA256SUMS.txt -tag "$GITHUB_REF_NAME" -pubfile "${PUBKEY_FILE:-internal/update/pubkey.go}"
 
-      - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             dist/Syncer.exe