diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 09ca05f..b3c9225 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -143,7 +143,7 @@ jobs:
           export REGISTRY_AUTH_FILE=$HOME/.docker/config.json
           REGISTRY_PATH="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
 
-          # Loop über alle Tags ohne das problematische --patch-config Flag
+          # Loop über alle Tags
           for tag in ${{ steps.metadata.outputs.tags }}; do
             skopeo copy \
               --dest-compress-format=zstd \
@@ -152,9 +152,9 @@ jobs:
               docker://$REGISTRY_PATH:$tag
           done
 
-          # Den finalen Digest ermitteln und für den nächsten Schritt in GITHUB_ENV schreiben
-          DIGEST=$(skopeo inspect oci-archive:./chunkah-out/image.ociarchive --format '{{.Digest}}')
-          echo "FINAL_IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV
+          # KORREKTUR: Wir fragen den echten, finalen Digest direkt von GHCR ab
+          FINAL_REGISTRY_DIGEST=$(skopeo inspect docker://$REGISTRY_PATH:${{ env.DEFAULT_TAG }} --format '{{.Digest}}')
+          echo "REGISTRY_DIGEST=$FINAL_REGISTRY_DIGEST" >> $GITHUB_ENV
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
@@ -163,7 +163,8 @@ jobs:
       - name: Sign container image
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
         run: |
-          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.FINAL_IMAGE_DIGEST }}"
+          # Signiert den exakten, von der Registry bestätigten Digest
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.REGISTRY_DIGEST }}"
         env:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}