diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d8111a00dc82..9e108127dfe0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,7 +89,8 @@ jobs:
         run: |
           curl -sSLo cosign https://github.com/sigstore/cosign/releases/download/v2.2.0/cosign-linux-amd64
           chmod +x ./cosign
-          ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false k0s | tee k0s.sig
+          COSIGN_KEY="$(printf %s "$COSIGN_KEY" | base64 -d)" ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false --output-file=k0s.sig k0s
+          cat k0s.sig
 
       - name: Upload Release Assets - Binary
         uses: shogo82148/actions-upload-release-asset@v1.7.2
@@ -164,7 +165,8 @@ jobs:
         run: |
           curl -sSLo cosign https://github.com/sigstore/cosign/releases/download/v2.2.0/cosign-linux-amd64
           chmod +x ./cosign
-          ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false k0s.exe | tee k0s.exe.sig
+          COSIGN_KEY="$(printf %s "$COSIGN_KEY" | base64 -d)" ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false --output-file=k0s.exe.sig k0s.exe
+          cat k0s.exe.sig
 
       - name: Clean Docker
         run: |
@@ -231,7 +233,8 @@ jobs:
         run: |
           curl -sSLo cosign https://github.com/sigstore/cosign/releases/download/v2.2.0/cosign-linux-arm64
           chmod +x ./cosign
-          ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false k0s | tee k0s.sig
+          COSIGN_KEY="$(printf %s "$COSIGN_KEY" | base64 -d)" ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false --output-file=k0s.sig k0s
+          cat k0s.sig
 
       - name: Set up Go for smoke tests
         uses: actions/setup-go@v3
@@ -331,7 +334,8 @@ jobs:
         run: |
           curl -sSLo cosign https://github.com/sigstore/cosign/releases/download/v2.2.0/cosign-linux-arm
           chmod +x ./cosign
-          ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false k0s | tee k0s.sig
+          COSIGN_KEY="$(printf %s "$COSIGN_KEY" | base64 -d)" ./cosign sign-blob --key env://COSIGN_KEY --tlog-upload=false --output-file=k0s.sig k0s
+          cat k0s.sig
 
       - name: Set up Go for smoke tests
         uses: actions/setup-go@v3