diff --git a/.github/workflows/release-nuget.yml b/.github/workflows/release-nuget.yml
index 667c9a2..116f107 100644
--- a/.github/workflows/release-nuget.yml
+++ b/.github/workflows/release-nuget.yml
@@ -199,7 +199,7 @@ jobs:
       - name: Prepare owned binary signing catalog
         if: inputs.sign
         id: signing
-        uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers
+        uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main
         with:
           operation: prepare
           signing-files: ${{ inputs.signing-files }}
@@ -255,7 +255,7 @@ jobs:
 
       - name: Verify signed binaries
         if: inputs.sign
-        uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers
+        uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main
         with:
           operation: verify
           manifest: ${{ steps.signing.outputs.manifest }}
@@ -269,7 +269,7 @@ jobs:
 
       - name: Verify the exact binaries shipped in NuGet packages
         if: inputs.sign
-        uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers
+        uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main
         with:
           operation: verify-distribution
           directory: artifacts/nuget
diff --git a/.github/workflows/release-velopack.yml b/.github/workflows/release-velopack.yml
index 0036391..618b5aa 100644
--- a/.github/workflows/release-velopack.yml
+++ b/.github/workflows/release-velopack.yml
@@ -333,7 +333,7 @@ jobs:
       - name: Prepare owned binary signing catalog
         if: inputs.sign
         id: signing
-        uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers
+        uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main
         with:
           operation: prepare
           root: publish
@@ -395,7 +395,7 @@ jobs:
 
       - name: Verify signed binaries and preserved dependencies
         if: inputs.sign
-        uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers
+        uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main
         with:
           operation: verify
           manifest: ${{ steps.signing.outputs.manifest }}
@@ -510,7 +510,7 @@ jobs:
 
       - name: Verify final installer, portable, full update and CLI assets
         if: inputs.sign
-        uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers
+        uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main
         with:
           operation: verify-distribution
           directory: release