diff --git a/security/cosign/Makefile b/security/cosign/Makefile
index 9766fa711a8b..9fcb48325d8f 100644
--- a/security/cosign/Makefile
+++ b/security/cosign/Makefile
@@ -1,35 +1,35 @@
 PORTNAME=	cosign
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.6.0
+DISTVERSION=	2.6.1
 CATEGORIES=	security
 
 MAINTAINER=	bofh@FreeBSD.org
 COMMENT=	Signing OCI containers and other artifacts using Sigstore
 WWW=		https://www.sigstore.dev/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cpe go:modules
 CPE_VENDOR=	sigstore
 
 GO_MODULE=	github.com/sigstore/cosign/v2
 GO_TARGET=	./cmd/${PORTNAME}
 GO_BUILDFLAGS=	-ldflags="-buildid= \
 		-X sigs.k8s.io/release-utils/version.gitVersion=$(DISTVERSION) \
 		-X sigs.k8s.io/release-utils/version.gitCommit=$(GIT_HASH) \
 		-X sigs.k8s.io/release-utils/version.gitTreeState=clean \
 		-X sigs.k8s.io/release-utils/version.buildDate=${SOURCE_DATE_EPOCH:U${SOURCE_DATE_EPOCH_CMD:sh}}"
 
 PLIST_FILES=	bin/${PORTNAME}
 
-GIT_HASH=	37fbfc7018fb4d60a9a2c9175bd64c75dda5869a
+GIT_HASH=	634fabe54f9fbbab55d821a83ba93b2d25bdba5f
 
 .include <bsd.port.pre.mk>
 
 # Bring DISTINFO_FILE into scope so we can get the timestamp.
 SOURCE_DATE_EPOCH_CMD=	date -ur \
 			$$(${GREP} -m1 TIMESTAMP ${DISTINFO_FILE} | ${SED} -e 's/[^0-9]//g') \
 			'+%Y-%m-%dT%H:%M:%SZ'
 
 .include <bsd.port.post.mk>
diff --git a/security/cosign/distinfo b/security/cosign/distinfo
index 04260adacbe1..f7a8031a9264 100644
--- a/security/cosign/distinfo
+++ b/security/cosign/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1757797254
-SHA256 (go/security_cosign/cosign-v2.6.0/v2.6.0.mod) = 5bdb0b024ddd7ed55330cccaf993f544d68917acac507d0f3c78e22be77afabb
-SIZE (go/security_cosign/cosign-v2.6.0/v2.6.0.mod) = 17701
-SHA256 (go/security_cosign/cosign-v2.6.0/v2.6.0.zip) = 2952d765dacdaebf7c651cfbad99e4736a086a9732e3a42bf8e9ce963bc73ae3
-SIZE (go/security_cosign/cosign-v2.6.0/v2.6.0.zip) = 1366214
+TIMESTAMP = 1759523978
+SHA256 (go/security_cosign/cosign-v2.6.1/v2.6.1.mod) = 4d6e9e11c0efec4ed8d03058cd1b73a0f9a830b804fb59a42890e6ea7f91fea8
+SIZE (go/security_cosign/cosign-v2.6.1/v2.6.1.mod) = 17701
+SHA256 (go/security_cosign/cosign-v2.6.1/v2.6.1.zip) = 8821408a71dba7b6ed4b94cac23b8e0679a9d23419d83a3e4b303796d920c6d3
+SIZE (go/security_cosign/cosign-v2.6.1/v2.6.1.zip) = 1367164