diff --git a/go.mod b/go.mod
index 6c66a00..069d005 100644
--- a/go.mod
+++ b/go.mod
@@ -1,9 +1,9 @@
 module github.com/slsa-framework/source-tool
 
-go 1.25.7
+go 1.25.8
 
 require (
-	github.com/carabiner-dev/attestation v0.2.0
+	github.com/carabiner-dev/attestation v0.2.1
 	github.com/carabiner-dev/collector v0.2.8
 	github.com/carabiner-dev/signer v0.3.7
 	github.com/carabiner-dev/vcslocator v0.4.0
diff --git a/go.sum b/go.sum
index fcf4ce7..d8bc0a4 100644
--- a/go.sum
+++ b/go.sum
@@ -84,8 +84,8 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
 github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
-github.com/carabiner-dev/attestation v0.2.0 h1:vEqAIapcHjIoEQad9GrKtEx2czeu7t4cun+1bCEtN1o=
-github.com/carabiner-dev/attestation v0.2.0/go.mod h1:dLPe3DPL/0YpKJpNDCQJZdtkZIuWTAH1G0N8V5LJ41c=
+github.com/carabiner-dev/attestation v0.2.1 h1:VhjV5YlO9TsW50Sr/Zd54bdbZhhDAqgxC3kB9z1I+3Q=
+github.com/carabiner-dev/attestation v0.2.1/go.mod h1:O84vF84RZG3pJO/6BYrPs718bZviHF5DKajP1HsrDpw=
 github.com/carabiner-dev/collector v0.2.8 h1:TQCWbpdM8xIuJuj0seu6z0zNZVNzczqvCKuaist+lbk=
 github.com/carabiner-dev/collector v0.2.8/go.mod h1:TDQ75MeBpoIOSGCtTWQrTxwtYcj/9rIJjonCix4F4HQ=
 github.com/carabiner-dev/ghrfs v0.3.4 h1:XJoDXkuw+8KQPTC4oI0da8vLpnx7cfQBGgyjzo+Eqrc=