diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fce07f8..aebc3d1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: Release
+name: Release
 
 # Best practice 2026: Trigger on GitHub Release "published" event.
 # This is more secure than pushing tags directly because:
@@ -80,7 +80,7 @@ jobs:
 
       # Optional but recommended in 2026: Generate SLSA-style provenance
       - name: Generate artifact attestation
-        uses: actions/attest@109298582bf81ad578b4e72f0f0893b095a4a135
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763
         with:
           subject-path: dist/${{ matrix.artifact }}