diff --git a/gh.yaml b/gh.yaml
index f6fb80883bc..6f23070f688 100644
--- a/gh.yaml
+++ b/gh.yaml
@@ -1,7 +1,7 @@
 package:
   name: gh
   version: "2.83.1"
-  epoch: 2 # GHSA-j5w8-q4qc-rx2x
+  epoch: 3 # GHSA-4qg8-fj49-pxjh
   description: GitHub's official command line tool
   copyright:
     - license: MIT
@@ -32,6 +32,7 @@ pipeline:
     with:
       deps: |-
         golang.org/x/crypto@v0.45.0
+        github.com/sigstore/sigstore-go@v1.1.4
 
   - runs: make install prefix=${{targets.destdir}}/usr