diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index b41b5ca..7fcb2ed 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -81,7 +81,7 @@ jobs:
             --yes \
             --output-certificate crt.pem \
             --output-signature kwasm.sig \
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.build-tagged.outputs.digest }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:@${{ steps.build-tagged.outputs.digest }}
       -
         name: prepare assets for upload
         if: runner.os != 'Windows'
@@ -95,7 +95,7 @@ jobs:
               --certificate-oidc-issuer https://token.actions.githubusercontent.com \\
               --certificate-github-workflow-sha ${{ github.workflow_sha }} \\
               --certificate-github-workflow-repository voigt/kwasm-operator \\
-              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.build-tagged.outputs.digest }}
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:@${{ steps.build-tagged.outputs.digest }}
           EOF
           cp crt.pem kwasm.sig verify.txt _dist/
       -