diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6738b2b..2afa3d3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
     permissions:
       id-token: write # For signing.
       contents: write # For asset uploads.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v0.0.1
+    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.0
     with:
       go-version: 1.18
       config-file: .github/config-release.yml
diff --git a/pkg/provenance.go b/pkg/provenance.go
index 3e0b923..a97c983 100644
--- a/pkg/provenance.go
+++ b/pkg/provenance.go
@@ -357,8 +357,9 @@ func FindSigningCertificate(ctx context.Context, uuids []string, dssePayload dss
 		}
 
 		co := &cosign.CheckOpts{
-			RootCerts:      fulcio.GetRoots(),
-			CertOidcIssuer: certOidcIssuer,
+			RootCerts:         fulcio.GetRoots(),
+			IntermediateCerts: fulcio.GetIntermediates(),
+			CertOidcIssuer:    certOidcIssuer,
 		}
 		verifier, err := cosign.ValidateAndUnpackCert(cert, co)
 		if err != nil {
@@ -376,7 +377,6 @@ func FindSigningCertificate(ctx context.Context, uuids []string, dssePayload dss
 		fmt.Fprintf(os.Stderr, "Verified against tlog entry %d\n", *entry.LogIndex)
 		return cert, nil
 	}
-
 	return nil, ErrorNoValidRekorEntries
 }