diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 627d1bd..b18b496 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@
 #
 #   cosign verify-blob \
 #     --certificate-identity-regexp \
-#       'https://github.com/tracebloc/cli/.github/workflows/release.yml@.*' \
+#       'https://github.com/tracebloc/cli/.github/workflows/release.yml@refs/tags/v.*' \
 #     --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
 #     --certificate <binary>.cert \
 #     --signature <binary>.sig \
diff --git a/scripts/install.sh b/scripts/install.sh
index dcac1f5..312ee66 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -361,7 +361,7 @@ verify_cosign_signature() {
 
     if "$COSIGN_BIN" verify-blob \
             --certificate-identity-regexp \
-              "https://github.com/${GITHUB_REPO}/.github/workflows/release.yml@.*" \
+              "https://github.com/${GITHUB_REPO}/.github/workflows/release.yml@refs/tags/v.*" \
             --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
             --certificate "$TMP/$BINARY_FILE.cert" \
             --signature "$TMP/$BINARY_FILE.sig" \