diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index cf69c02..c9354e9 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -81,8 +81,8 @@ jobs:
             ostree.bootable=1
 
       - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
         if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY_HOST }}
           username: ${{ github.repository_owner }}
@@ -104,15 +104,17 @@ jobs:
           sudo apt-get update && sudo apt-get install -y gettext
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.1.2
         if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@v4.1.2
 
-      - name: Sign container image
+      - name: Sign container image (OCI Referrers Mode)
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
         run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build_image.outputs.digest }}"
+          cosign sign -y \
+            --registry-referrers-api=oci \
+            --key env://COSIGN_PRIVATE_KEY \
+            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build_image.outputs.digest }}"
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-          # Verhindert, dass Cosign interaktiv nach einem Passwort sucht:
           COSIGN_PASSWORD: ""