diff --git a/.github/workflows/release-supply-chain.yml b/.github/workflows/release-supply-chain.yml
index 57062d6..ed68556 100644
--- a/.github/workflows/release-supply-chain.yml
+++ b/.github/workflows/release-supply-chain.yml
@@ -148,7 +148,9 @@ jobs:
           subject-path: dist/${{ inputs.package_name }}-${{ inputs.version }}.tar.gz
 
       - name: Attest SBOM (archive)
-        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e  # v4.1.0
+        # actions/attest native SBOM mode (sbom-path) replaces the deprecated
+        # actions/attest-sbom; the SPDX predicate type is unchanged.
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
         with:
           subject-path: dist/${{ inputs.package_name }}-${{ inputs.version }}.tar.gz
           sbom-path: dist/sbom.spdx.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f88fc7c..c772620 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+### Changed
+
+- Migrate the SBOM attestation from the deprecated `actions/attest-sbom` to
+  `actions/attest` (native SBOM mode via `sbom-path`, an identical interface).
+  The SPDX predicate type and `scripts/verify_attestations.sh` verification are
+  unchanged.
+
 ## [0.3.0] - 2026-07-08
 
 ### Added
diff --git a/catalog/capabilities.yml b/catalog/capabilities.yml
index 0adc37e..91158bb 100644
--- a/catalog/capabilities.yml
+++ b/catalog/capabilities.yml
@@ -371,7 +371,7 @@ capabilities:
     required_settings:
       - "Dependency graph enabled for the dependency-graph SBOM API (GET /repos/{owner}/{repo}/dependency-graph/sbom)"
     risks:
-      - "attest-sbom requires SPDX or CycloneDX JSON; anchore/sbom-action is configured for spdx-json"
+      - "actions/attest (SBOM mode) requires SPDX or CycloneDX JSON; anchore/sbom-action is configured for spdx-json"
     deprecations: null
     last_verified: "2026-07-04"
     sources:
diff --git a/catalog/tools.yml b/catalog/tools.yml
index e3846b7..c85371e 100644
--- a/catalog/tools.yml
+++ b/catalog/tools.yml
@@ -119,17 +119,7 @@ tools:
     pin: "actions/attest@a1948c3f048ba23858d222213b7c278aabede763"
     used_by:
       - .github/workflows/release-supply-chain.yml
-    last_verified: "2026-07-04"
-
-  - id: attest-sbom
-    name: actions/attest-sbom
-    homepage: "https://github.com/actions/attest-sbom"
-    kind: action
-    current_version: "v4.1.0"
-    pin: "actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e"
-    used_by:
-      - .github/workflows/release-supply-chain.yml
-    last_verified: "2026-07-04"
+    last_verified: "2026-07-08"
 
   - id: attest-build-provenance
     name: actions/attest-build-provenance