diff --git a/registry.toml b/registry.toml
index 2eef877f64..6ab862a5f6 100644
--- a/registry.toml
+++ b/registry.toml
@@ -1593,6 +1593,7 @@ psc-package.backends = [
 ]
 psqldef.backends = ["aqua:sqldef/sqldef/psqldef"]
 pulumi.backends = ["aqua:pulumi/pulumi", "asdf:canha/asdf-pulumi"]
+pulumi.test = ["pulumi version", "v{{version}}"]
 purerl.backends = ["ubi:purerl/purerl", "asdf:GoNZooo/asdf-purerl"]
 purescript.backends = [
     "ubi:purescript/purescript[exe=purs]",
diff --git a/src/aqua/aqua_registry.rs b/src/aqua/aqua_registry.rs
index fcaea4aed1..1041653091 100644
--- a/src/aqua/aqua_registry.rs
+++ b/src/aqua/aqua_registry.rs
@@ -137,6 +137,7 @@ pub struct AquaCosign {
     pub signature: Option<AquaCosignSignature>,
     pub key: Option<AquaCosignSignature>,
     pub certificate: Option<AquaCosignSignature>,
+    pub bundle: Option<AquaCosignSignature>,
     #[serde(skip_serializing_if = "Vec::is_empty", default)]
     opts: Vec<String>,
 }
@@ -688,6 +689,12 @@ impl AquaCosign {
             }
             self.certificate.as_mut().unwrap().merge(certificate);
         }
+        if let Some(bundle) = other.bundle.clone() {
+            if self.bundle.is_none() {
+                self.bundle = Some(bundle.clone());
+            }
+            self.bundle.as_mut().unwrap().merge(bundle);
+        }
         if !other.opts.is_empty() {
             self.opts = other.opts.clone();
         }
diff --git a/src/backend/aqua.rs b/src/backend/aqua.rs
index e2a3e96410..55b09ad6c3 100644
--- a/src/backend/aqua.rs
+++ b/src/backend/aqua.rs
@@ -304,10 +304,11 @@ impl AquaBackend {
                         }
                         AquaChecksumType::Http => checksum.url(pkg, v)?,
                     };
-                    let checksum_path = tv.download_path().join(format!("{filename}.checksum"));
+                    let download_path = tv.download_path();
+                    let checksum_path = download_path.join(format!("{filename}.checksum"));
                     HTTP.download_file(&url, &checksum_path, Some(&ctx.pr))
                         .await?;
-                    self.cosign_checksums(ctx, pkg, v, tv, &checksum_path)
+                    self.cosign_checksums(ctx, pkg, v, tv, &checksum_path, &download_path)
                         .await?;
                     let mut checksum_file = file::read_to_string(&checksum_path)?;
                     if checksum.file_format() == "regexp" {
@@ -514,6 +515,7 @@ impl AquaBackend {
         v: &str,
         tv: &ToolVersion,
         checksum_path: &Path,
+        download_path: &Path,
     ) -> Result<()> {
         if !Settings::get().aqua.cosign {
             return Ok(());
@@ -553,6 +555,16 @@ impl AquaBackend {
                         cmd = cmd.arg("--certificate").arg(arg);
                     }
                 }
+                if let Some(bundle) = &cosign.bundle {
+                    let url = bundle.arg(pkg, v)?;
+                    if !url.is_empty() {
+                        let filename = url.split('/').next_back().unwrap();
+                        let bundle_path = download_path.join(filename);
+                        HTTP.download_file(&url, &bundle_path, Some(&ctx.pr))
+                            .await?;
+                        cmd = cmd.arg("--bundle").arg(bundle_path);
+                    }
+                }
                 for opt in cosign.opts(pkg, v)? {
                     cmd = cmd.arg(opt);
                 }