diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index 8e5d1c4..71465bc 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -41,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          go-version: "1.26.x"
+          go-version: "1.27.x"
 
       - name: Validate workflows
         run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
diff --git a/.github/workflows/build-push.yaml b/.github/workflows/build-push.yaml
index 163f538..fb3f41e 100644
--- a/.github/workflows/build-push.yaml
+++ b/.github/workflows/build-push.yaml
@@ -613,7 +613,7 @@ jobs:
         if: inputs.sign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: v3.1.3 # renovate: datasource=github-releases depName=sigstore/cosign
+          cosign-release: v3.1.4 # renovate: datasource=github-releases depName=sigstore/cosign
 
       - name: Install checksum-verified Syft
         if: inputs.sign
diff --git a/.github/workflows/sitectl-plugin-goreleaser.yaml b/.github/workflows/sitectl-plugin-goreleaser.yaml
index 25860a0..bf146a2 100644
--- a/.github/workflows/sitectl-plugin-goreleaser.yaml
+++ b/.github/workflows/sitectl-plugin-goreleaser.yaml
@@ -211,7 +211,7 @@ jobs:
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           distribution: goreleaser
-          version: v2.17.0
+          version: v2.18.3
           args: ${{ inputs.goreleaser-args }}
         env:
           GORELEASER_DISABLE_SCM_RELEASE: "false"