diff --git a/.github/workflows/kl.yml b/.github/workflows/kl.yml
index bbb3c24f..00fab91b 100644
--- a/.github/workflows/kl.yml
+++ b/.github/workflows/kl.yml
@@ -70,7 +70,7 @@ jobs:
       # `sha256sums` proves a download is intact; this proves it came from THIS workflow on THIS
       # commit (`gh attestation verify kl-<target> -R kloudlite/kloudlite-git`). Free for a public
       # repo, and the only origin signal `install.sh`'s same-origin checksum cannot give.
-      - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/kl-*
       - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2