diff --git a/security/cosign/Makefile b/security/cosign/Makefile
index 3a9830b51229..bb5021482fdf 100644
--- a/security/cosign/Makefile
+++ b/security/cosign/Makefile
@@ -1,36 +1,35 @@
 PORTNAME=	cosign
 DISTVERSIONPREFIX=	v
-DISTVERSION=	2.6.2
-PORTREVISION=	3
+DISTVERSION=	3.0.0
 CATEGORIES=	security
 
 MAINTAINER=	bofh@FreeBSD.org
 COMMENT=	Signing OCI containers and other artifacts using Sigstore
 WWW=		https://www.sigstore.dev/
 
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		cpe go:modules
 CPE_VENDOR=	sigstore
 
-GO_MODULE=	github.com/sigstore/cosign/v2
+GO_MODULE=	github.com/sigstore/cosign/v3
 GO_TARGET=	./cmd/${PORTNAME}
 GO_BUILDFLAGS=	-ldflags="-buildid= \
 		-X sigs.k8s.io/release-utils/version.gitVersion=$(DISTVERSION) \
 		-X sigs.k8s.io/release-utils/version.gitCommit=$(GIT_HASH) \
 		-X sigs.k8s.io/release-utils/version.gitTreeState=clean \
 		-X sigs.k8s.io/release-utils/version.buildDate=${SOURCE_DATE_EPOCH:U${SOURCE_DATE_EPOCH_CMD:sh}}"
 
 PLIST_FILES=	bin/${PORTNAME}
 
-GIT_HASH=	3ade80c5f77cefc904f8c994e88618e5892e8f1c
+GIT_HASH=	18f981e04b092593cb12a4d6982dfd19deca758a
 
 .include <bsd.port.pre.mk>
 
 # Bring DISTINFO_FILE into scope so we can get the timestamp.
 SOURCE_DATE_EPOCH_CMD=	date -ur \
 			$$(${GREP} -m1 TIMESTAMP ${DISTINFO_FILE} | ${SED} -e 's/[^0-9]//g') \
 			'+%Y-%m-%dT%H:%M:%SZ'
 
 .include <bsd.port.post.mk>
diff --git a/security/cosign/distinfo b/security/cosign/distinfo
index 6600e9712449..ca8b22087753 100644
--- a/security/cosign/distinfo
+++ b/security/cosign/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1768382010
-SHA256 (go/security_cosign/cosign-v2.6.2/v2.6.2.mod) = a4f4e1951ebd21b49e6eed788cd3b07c060d675e28aeaa4abfceb13d3a94b5c4
-SIZE (go/security_cosign/cosign-v2.6.2/v2.6.2.mod) = 16305
-SHA256 (go/security_cosign/cosign-v2.6.2/v2.6.2.zip) = 0bbc52daacd7e7f1ac5478948fbdd6a3ea4fab2d3261e37e7afb97caa1fbdfbe
-SIZE (go/security_cosign/cosign-v2.6.2/v2.6.2.zip) = 1319893
+TIMESTAMP = 1771762603
+SHA256 (go/security_cosign/cosign-v3.0.0/v3.0.0.mod) = 2c331e5706defe44892045dee9fa1074b8b1302de3cf5c2484b185f51ee4b11c
+SIZE (go/security_cosign/cosign-v3.0.0/v3.0.0.mod) = 17717
+SHA256 (go/security_cosign/cosign-v3.0.0/v3.0.0.zip) = 1b35e7bdba3bf8eaa9b8a5dbe63f1197bd5ef0c1d249f210d83b44ea081da7be
+SIZE (go/security_cosign/cosign-v3.0.0/v3.0.0.zip) = 1369256