diff --git a/security/cosign/Makefile b/security/cosign/Makefile
index 50bc7042755e..25aa6f4e1082 100644
--- a/security/cosign/Makefile
+++ b/security/cosign/Makefile
@@ -1,35 +1,35 @@
 PORTNAME=	cosign
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.5.1
+DISTVERSION=	2.5.2
 CATEGORIES=	security
 
 MAINTAINER=	bofh@FreeBSD.org
 COMMENT=	Signing OCI containers and other artifacts using Sigstore
 WWW=		https://www.sigstore.dev/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cpe go:modules
 CPE_VENDOR=	sigstore
 
 GO_MODULE=	github.com/sigstore/cosign/v2
 GO_TARGET=	./cmd/${PORTNAME}
 GO_BUILDFLAGS=	-ldflags="-buildid= \
 		-X sigs.k8s.io/release-utils/version.gitVersion=$(DISTVERSION) \
 		-X sigs.k8s.io/release-utils/version.gitCommit=$(GIT_HASH) \
 		-X sigs.k8s.io/release-utils/version.gitTreeState=clean \
 		-X sigs.k8s.io/release-utils/version.buildDate=${SOURCE_DATE_EPOCH:U${SOURCE_DATE_EPOCH_CMD:sh}}"
 
 PLIST_FILES=	bin/${PORTNAME}
 
-GIT_HASH=	a7345fb2ce17b52b5bc687970fa31ff85bc2f7ca
+GIT_HASH=	af5a988bb15a03919ccaac7a2ddcad7a9d006f38
 
 .include <bsd.port.pre.mk>
 
 # Bring DISTINFO_FILE into scope so we can get the timestamp.
 SOURCE_DATE_EPOCH_CMD=	date -ur \
 			$$(${GREP} -m1 TIMESTAMP ${DISTINFO_FILE} | ${SED} -e 's/[^0-9]//g') \
 			'+%Y-%m-%dT%H:%M:%SZ'
 
 .include <bsd.port.post.mk>
diff --git a/security/cosign/distinfo b/security/cosign/distinfo
index 6094ea46b910..621a1398dec8 100644
--- a/security/cosign/distinfo
+++ b/security/cosign/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1751272854
-SHA256 (go/security_cosign/cosign-v2.5.1/v2.5.1.mod) = 73cd50764e440cee0dc08dd15dbe489d880980170cef56164f3f351a3c861bac
-SIZE (go/security_cosign/cosign-v2.5.1/v2.5.1.mod) = 15329
-SHA256 (go/security_cosign/cosign-v2.5.1/v2.5.1.zip) = d2a7631cb2b26181682af19fc7d067da852b9edee54e3124fddcf1b82c7663d4
-SIZE (go/security_cosign/cosign-v2.5.1/v2.5.1.zip) = 1274453
+TIMESTAMP = 1751444102
+SHA256 (go/security_cosign/cosign-v2.5.2/v2.5.2.mod) = 5bc5ad2f641929f53eeb4fcec33fba55b78a51cf707f53f74feae8a0e7ad0bae
+SIZE (go/security_cosign/cosign-v2.5.2/v2.5.2.mod) = 15326
+SHA256 (go/security_cosign/cosign-v2.5.2/v2.5.2.zip) = 91f0aebf97ae40581273a4e44fad958ce7ff02dd232663f9fffd074596efa82e
+SIZE (go/security_cosign/cosign-v2.5.2/v2.5.2.zip) = 1274354