diff --git a/pkgs/openvex/vexctl/pkg.yaml b/pkgs/openvex/vexctl/pkg.yaml
index 5b8ac99dfa..70cc49396f 100644
--- a/pkgs/openvex/vexctl/pkg.yaml
+++ b/pkgs/openvex/vexctl/pkg.yaml
@@ -2,5 +2,3 @@ packages:
   - name: openvex/vexctl@v0.3.0
   - name: openvex/vexctl
     version: v0.2.5
-  - name: openvex/vexctl
-    version: v0.2.0
diff --git a/pkgs/openvex/vexctl/registry.yaml b/pkgs/openvex/vexctl/registry.yaml
index 916ae46251..20225e8d39 100644
--- a/pkgs/openvex/vexctl/registry.yaml
+++ b/pkgs/openvex/vexctl/registry.yaml
@@ -6,22 +6,59 @@ packages:
     description: A  tool to create, transform and attest VEX metadata
     version_constraint: "false"
     version_overrides:
-      - version_constraint: semver("<= 0.2.0")
       - version_constraint: semver("<= 0.2.5")
         asset: vexctl-{{.OS}}-{{.Arch}}
         format: raw
         windows_arm_emulation: true
-        complete_windows_ext: false
         checksum:
           type: github_release
           asset: vex_checksums.txt
           algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity-regexp
+              - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+              - --certificate-oidc-issuer
+              - "https://token.actions.githubusercontent.com"
+              - --signature
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vex_checksums.txt.sig
+              - --certificate
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vex_checksums.txt.pem
+        cosign:
+          opts:
+            - --certificate-identity-regexp
+            - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+            - --certificate-oidc-issuer
+            - "https://token.actions.githubusercontent.com"
+            - --signature
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.sig
+            - --certificate
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.pem
       - version_constraint: "true"
         asset: vexctl-{{.OS}}-{{.Arch}}
         format: raw
         windows_arm_emulation: true
-        complete_windows_ext: false
         checksum:
           type: github_release
           asset: vexctl_checksums.txt
           algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity-regexp
+              - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+              - --certificate-oidc-issuer
+              - "https://token.actions.githubusercontent.com"
+              - --signature
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vexctl_checksums.txt.sig
+              - --certificate
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vexctl_checksums.txt.pem
+        cosign:
+          opts:
+            - --certificate-identity-regexp
+            - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+            - --certificate-oidc-issuer
+            - "https://token.actions.githubusercontent.com"
+            - --signature
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.sig
+            - --certificate
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.pem
diff --git a/registry.yaml b/registry.yaml
index d301430466..9f554c3b8d 100644
--- a/registry.yaml
+++ b/registry.yaml
@@ -39903,25 +39903,62 @@ packages:
     description: A  tool to create, transform and attest VEX metadata
     version_constraint: "false"
     version_overrides:
-      - version_constraint: semver("<= 0.2.0")
       - version_constraint: semver("<= 0.2.5")
         asset: vexctl-{{.OS}}-{{.Arch}}
         format: raw
         windows_arm_emulation: true
-        complete_windows_ext: false
         checksum:
           type: github_release
           asset: vex_checksums.txt
           algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity-regexp
+              - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+              - --certificate-oidc-issuer
+              - "https://token.actions.githubusercontent.com"
+              - --signature
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vex_checksums.txt.sig
+              - --certificate
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vex_checksums.txt.pem
+        cosign:
+          opts:
+            - --certificate-identity-regexp
+            - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+            - --certificate-oidc-issuer
+            - "https://token.actions.githubusercontent.com"
+            - --signature
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.sig
+            - --certificate
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.pem
       - version_constraint: "true"
         asset: vexctl-{{.OS}}-{{.Arch}}
         format: raw
         windows_arm_emulation: true
-        complete_windows_ext: false
         checksum:
           type: github_release
           asset: vexctl_checksums.txt
           algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity-regexp
+              - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+              - --certificate-oidc-issuer
+              - "https://token.actions.githubusercontent.com"
+              - --signature
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vexctl_checksums.txt.sig
+              - --certificate
+              - https://github.com/openvex/vexctl/releases/download/{{.Version}}/vexctl_checksums.txt.pem
+        cosign:
+          opts:
+            - --certificate-identity-regexp
+            - "https://github\\.com/openvex/vexctl/\\.github/workflows/release\\.yaml@.*"
+            - --certificate-oidc-issuer
+            - "https://token.actions.githubusercontent.com"
+            - --signature
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.sig
+            - --certificate
+            - https://github.com/openvex/vexctl/releases/download/{{.Version}}/{{.Asset}}.pem
   - type: github_release
     repo_owner: openziti
     repo_name: zrok