diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 4c79c450..e0f21b3e 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -23,9 +23,12 @@ source:
   enabled: true
 signs:
   - cmd: cosign
+    certificate: '${artifact}.pem'
+    signature: '${artifact}.sig'
     args:
       - "sign-blob"
       - "--output-signature=${signature}"
+      - '--output-certificate=${certificate}'
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
     artifacts: all