diff --git a/.github/workflows/release-sign.yml b/.github/workflows/release-sign.yml
index 9946326199..8bcc5e9147 100644
--- a/.github/workflows/release-sign.yml
+++ b/.github/workflows/release-sign.yml
@@ -55,7 +55,7 @@ jobs:
         run: git archive --format=tar.gz -o ${OCIO_TARBALL} --prefix ${OCIO_PREFIX} ${TAG}
 
       - name: Sign archive with Sigstore
-        uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d # v3.2.0
+        uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
         with:
           inputs: ${{ env.OCIO_TARBALL }}
           upload-signing-artifacts: false