diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a54ff09a8b..8e1db0f9d8 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -61,10 +61,15 @@ jobs:
 
         echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
         
-        # Get the digest of the pushed image. The --format option can be unreliable,
-        # so we parse the full JSON output to find the digest of the manifest list.
-        MANIFEST_JSON=$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:${VERSION})
-        echo "DIGEST=$(echo "${MANIFEST_JSON}" | grep '"digest"' | head -n 1 | cut -d '"' -f 4)" >> $GITHUB_OUTPUT
+        # Get the digest of the pushed manifest list (top-level manifest list digest)
+        # Avoid relying on template fields (which vary across buildx versions) and avoid -e exit on failure
+        INSPECT_OUTPUT=$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:${VERSION} || true)
+        DIGEST=$(printf "%s\n" "$INSPECT_OUTPUT" | awk '/^Digest:/ {print $2; exit}')
+        if [ -z "$DIGEST" ]; then
+          echo "Error: Could not determine image digest for ghcr.io/berachain/bera-geth:${VERSION}"
+          exit 1
+        fi
+        echo "DIGEST=${DIGEST}" >> $GITHUB_OUTPUT
     outputs:
       VERSION: ${{ steps.image_info.outputs.VERSION }}
       DIGEST: ${{ steps.image_info.outputs.DIGEST }}
@@ -97,6 +102,7 @@ jobs:
     - name: Sign Docker images with Cosign
       env:
         COSIGN_EXPERIMENTAL: true
+        COSIGN_YES: "true"
       run: |
         # Sign the tagged version if it exists
         if [ -n "${{ env.VERSION }}" ]; then
@@ -104,4 +110,9 @@ jobs:
         fi
         
         # Sign the multi-arch manifest by digest
-        cosign sign --yes ghcr.io/berachain/bera-geth@${{ env.DIGEST }}
+        if [ -n "${{ env.DIGEST }}" ]; then
+          cosign sign --yes ghcr.io/berachain/bera-geth@${{ env.DIGEST }}
+        else
+          echo "Error: DIGEST is empty. Skipping digest signing."
+          exit 1
+        fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c3372e85e0..cdeb9a6fd5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -211,11 +211,22 @@ jobs:
         
         ### Docker Images
         
-        Docker images are available at `ghcr.io/berachain/bera-geth` and are signed with [Cosign](https://github.com/sigstore/cosign).
+        Docker images are available at `ghcr.io/berachain/bera-geth` and are signed with [Cosign](https://github.com/sigstore/cosign) using keyless signing from GitHub Actions OIDC.
         
-        To verify Docker images:
+        To verify a specific release image (recommended: by digest):
         ```bash
-        cosign verify ghcr.io/berachain/bera-geth:RELEASE_TAG_PLACEHOLDER
+        cosign verify \
+          --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+          --certificate-identity-regexp "^https://github.com/berachain/bera-geth/.github/workflows/docker.yml@.+" \
+          ghcr.io/berachain/bera-geth@$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:RELEASE_TAG_PLACEHOLDER | awk '/^Digest:/ {print $2; exit}')
+        ```
+        
+        To verify the `latest` unstable image instead (not recommended; tags can move):
+        ```bash
+        cosign verify \
+          --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+          --certificate-identity-regexp "^https://github.com/berachain/bera-geth/.github/workflows/docker.yml@.+" \
+          ghcr.io/berachain/bera-geth@$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:latest | awk '/^Digest:/ {print $2; exit}')
         ```
         
         ### Installation