diff --git a/.github/workflows/sign.yml b/.github/workflows/sign.yml
index c858263..2ec5dd1 100644
--- a/.github/workflows/sign.yml
+++ b/.github/workflows/sign.yml
@@ -58,9 +58,10 @@ jobs:
         id: oidc
         uses: actions/github-script@v7
         with:
+          result-encoding: string
           script: |
-            // return GitHub OIDC token scoped for sigstore
-            return await github.actions.getOIDCToken({audience: 'sigstore'});
+            // minimal OIDC fetch for Sigstore
+            return await core.getIDToken('sigstore');
 
       - name: Keyless sign installers
         env: