diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a39df72..3ff0b8d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -103,7 +103,7 @@ jobs:
       # <product>-release-signatures context, which is permanent: changing it
       # invalidates every signature already published against it.
       - name: Sign bundle with ML-DSA-87
-        uses: theQRL/actions-mldsa-sign@97a05abefff417d595c28c7b5d9d886ebe2fe9d0 # v1.0.0
+        uses: theQRL/actions-mldsa-sign@266287af83f2b1a8ec4c6e13149d0ecf6cd16cc5 # v2.0.0
         with:
           patterns: ${{ steps.artefact.outputs.name }}
           hexseed: ${{ secrets.MLDSA_HEXSEED }}