diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index ffc2e9d..4997e2e 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -105,3 +105,4 @@ signs:
       - "--yes" # needed on cosign 2.0.0+
     artifacts: archive
     output: true
+    certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'