diff --git a/vexctl.yaml b/vexctl.yaml
index 123d2eab92d..5158f0a2feb 100644
--- a/vexctl.yaml
+++ b/vexctl.yaml
@@ -1,7 +1,7 @@
 package:
   name: vexctl
   version: "0.4.1"
-  epoch: 3 # GHSA-j5w8-q4qc-rx2x
+  epoch: 4 # GHSA-f83f-xpx7-ffpw
   description: A tool to create, transform and attest VEX metadata
   copyright:
     - license: Apache-2.0
@@ -17,6 +17,7 @@ pipeline:
     with:
       deps: |-
         golang.org/x/crypto@v0.45.0
+        github.com/sigstore/fulcio@v1.8.3
 
   - uses: go/build
     with: