diff --git a/security/cosign/Makefile b/security/cosign/Makefile
index 8ebd701d5309..2370cb820f3e 100644
--- a/security/cosign/Makefile
+++ b/security/cosign/Makefile
@@ -1,36 +1,35 @@
 PORTNAME=	cosign
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.6.1
-PORTREVISION=	4
+DISTVERSION=	2.6.2
 CATEGORIES=	security
 
 MAINTAINER=	bofh@FreeBSD.org
 COMMENT=	Signing OCI containers and other artifacts using Sigstore
 WWW=		https://www.sigstore.dev/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cpe go:modules
 CPE_VENDOR=	sigstore
 
 GO_MODULE=	github.com/sigstore/cosign/v2
 GO_TARGET=	./cmd/${PORTNAME}
 GO_BUILDFLAGS=	-ldflags="-buildid= \
 		-X sigs.k8s.io/release-utils/version.gitVersion=$(DISTVERSION) \
 		-X sigs.k8s.io/release-utils/version.gitCommit=$(GIT_HASH) \
 		-X sigs.k8s.io/release-utils/version.gitTreeState=clean \
 		-X sigs.k8s.io/release-utils/version.buildDate=${SOURCE_DATE_EPOCH:U${SOURCE_DATE_EPOCH_CMD:sh}}"
 
 PLIST_FILES=	bin/${PORTNAME}
 
-GIT_HASH=	634fabe54f9fbbab55d821a83ba93b2d25bdba5f
+GIT_HASH=	3ade80c5f77cefc904f8c994e88618e5892e8f1c
 
 .include <bsd.port.pre.mk>
 
 # Bring DISTINFO_FILE into scope so we can get the timestamp.
 SOURCE_DATE_EPOCH_CMD=	date -ur \
 			$$(${GREP} -m1 TIMESTAMP ${DISTINFO_FILE} | ${SED} -e 's/[^0-9]//g') \
 			'+%Y-%m-%dT%H:%M:%SZ'
 
 .include <bsd.port.post.mk>
diff --git a/security/cosign/distinfo b/security/cosign/distinfo
index f7a8031a9264..6600e9712449 100644
--- a/security/cosign/distinfo
+++ b/security/cosign/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1759523978
-SHA256 (go/security_cosign/cosign-v2.6.1/v2.6.1.mod) = 4d6e9e11c0efec4ed8d03058cd1b73a0f9a830b804fb59a42890e6ea7f91fea8
-SIZE (go/security_cosign/cosign-v2.6.1/v2.6.1.mod) = 17701
-SHA256 (go/security_cosign/cosign-v2.6.1/v2.6.1.zip) = 8821408a71dba7b6ed4b94cac23b8e0679a9d23419d83a3e4b303796d920c6d3
-SIZE (go/security_cosign/cosign-v2.6.1/v2.6.1.zip) = 1367164
+TIMESTAMP = 1768382010
+SHA256 (go/security_cosign/cosign-v2.6.2/v2.6.2.mod) = a4f4e1951ebd21b49e6eed788cd3b07c060d675e28aeaa4abfceb13d3a94b5c4
+SIZE (go/security_cosign/cosign-v2.6.2/v2.6.2.mod) = 16305
+SHA256 (go/security_cosign/cosign-v2.6.2/v2.6.2.zip) = 0bbc52daacd7e7f1ac5478948fbdd6a3ea4fab2d3261e37e7afb97caa1fbdfbe
+SIZE (go/security_cosign/cosign-v2.6.2/v2.6.2.zip) = 1319893