diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 4b91276..4905dd6 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -37,12 +37,13 @@ checksum:
 
 signs:
   - cmd: cosign
-    certificate: "${artifact}.pem"
+    # cosign v3 writes one sigstore bundle (certificate + signature + log entry).
+    # Verify: cosign verify-blob --bundle checksums.txt.sigstore.json checksums.txt
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - --yes
-      - --output-certificate=${certificate}
-      - --output-signature=${signature}
+      - --bundle=${signature}
       - ${artifact}
     artifacts: checksum
     output: true