diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bc04fd91..0a81f1b0 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -41,18 +41,19 @@ sboms:
       - "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom.spdx.json"
 
 signs:
-  # cosign keyless signing (OIDC + sigstore)
+  # cosign keyless signing (OIDC + sigstore). cosign v3 defaults to the
+  # Sigstore bundle format and no longer supports the separate
+  # --output-signature/--output-certificate outputs, so the signature and
+  # certificate are packaged together in a single .bundle artifact.
   - id: cosign
     cmd: cosign
     args:
       - sign-blob
-      - --output-certificate=${certificate}
-      - --output-signature=${signature}
+      - --bundle=${signature}
       - ${artifact}
       - --yes
     artifacts: checksum
-    signature: "${artifact}.sig"
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.bundle"
     output: true
 
   # GPG signing. The release key has no passphrase (it lives only as a repo
diff --git a/docs/release-verification.md b/docs/release-verification.md
index 042f1304..1325efc3 100644
--- a/docs/release-verification.md
+++ b/docs/release-verification.md
@@ -8,20 +8,19 @@ Cascade uses keyless cosign signing via Sigstore, which does not require key man
 
 1. Install cosign (https://github.com/sigstore/cosign/releases).
 
-2. Download the release artifacts and signatures from the GitHub release page (checksums.txt, checksums.txt.sig, checksums.txt.pem, and the archives).
+2. Download the release artifacts and the signature bundle from the GitHub release page (checksums.txt, checksums.txt.bundle, and the archives). The bundle packages the signature and the signing certificate together in the Sigstore bundle format.
 
 3. Verify the checksums file signature:
 
 ```bash
 cosign verify-blob \
-  --certificate=checksums.txt.pem \
-  --signature=checksums.txt.sig \
+  --bundle=checksums.txt.bundle \
   --certificate-identity-regexp='^https://github.com/stablekernel/cascade' \
   --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
   checksums.txt
 ```
 
-The certificate is issued by Sigstore's public certificate authority. cosign automatically verifies the certificate chain and confirms the signature was created by GitHub Actions during the release workflow run.
+The bundle contains the signature and the certificate issued by Sigstore's public certificate authority. cosign automatically verifies the certificate chain and confirms the signature was created by GitHub Actions during the release workflow run.
 
 4. Verify the checksums match the downloaded binaries: