diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index dff016c..8f42228 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -78,6 +78,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
+        uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
         with:
           sarif_file: results.sarif
diff --git a/charts/attest-provider/Chart.yaml b/charts/attest-provider/Chart.yaml
index b148b0f..4fa1f4c 100644
--- a/charts/attest-provider/Chart.yaml
+++ b/charts/attest-provider/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 description: A Helm chart for attest external data provider
 name: attest-provider
-version: 0.0.8
+version: 0.0.10
 home: https://github.com/docker/attest-provider
 sources:
   - https://github.com/docker/attest-provider.git
-appVersion: 0.0.8
+appVersion: 0.0.10
diff --git a/charts/attest-provider/README.md b/charts/attest-provider/README.md
index 107b13e..5b71ae2 100644
--- a/charts/attest-provider/README.md
+++ b/charts/attest-provider/README.md
@@ -8,6 +8,7 @@
 |port|port for provider service|`8090`|
 |handlerTimeout|timeout in seconds for provider HTTP handler|`25`|
 |replicas|number of provider replicas in deployment|`1`|
+|serviceAccountName|name of service account to attach to provider pods|``|
 |tufRoot|name of embedded Docker TUF root to use for client (`dev`, `staging`, `prod`)|`prod`|
 |tufMetadataSource|URI for TUF metadata (registry or http source)|`registry-1.docker.io/docker/tuf-metadata`|
 |tufTargetsSource|URI for TUF targets (registry or http source)|`registry-1.docker.io/docker/tuf-targets`|
diff --git a/charts/attest-provider/templates/attest-provider-deployment.yaml b/charts/attest-provider/templates/attest-provider-deployment.yaml
index 7a74fc6..ddad379 100644
--- a/charts/attest-provider/templates/attest-provider-deployment.yaml
+++ b/charts/attest-provider/templates/attest-provider-deployment.yaml
@@ -15,6 +15,9 @@ spec:
         app: '{{ template "attest-provider.name" . }}'
         chart: '{{ template "attest-provider.name" . }}'
     spec:
+      {{- if .Values.serviceAccountName }}
+      serviceAccountName: {{ .Values.serviceAccountName }}
+      {{- end }}
       containers:
       - image: {{ .Values.image }}
         imagePullPolicy: IfNotPresent
diff --git a/charts/attest-provider/values.yaml b/charts/attest-provider/values.yaml
index db24cf5..a9528f9 100644
--- a/charts/attest-provider/values.yaml
+++ b/charts/attest-provider/values.yaml
@@ -1,4 +1,4 @@
-image: "docker/attest-provider:0.0.8@sha256:ad61961bbb9779822e8627c9ddb5c2f29c1ece4ecf9577fb81df02eb108a59ef"
+image: "docker/attest-provider:0.0.10@sha256:891da7141dff7e433f64b07d64c89693f029da08349ef8775ba7e064db9d3a9b"
 
 certDir: /certs
 clientCAFile: /tmp/gatekeeper/ca.crt
diff --git a/go.mod b/go.mod
index 88c7035..bbd913f 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/docker/attest-provider
 go 1.22.5
 
 require (
-	github.com/docker/attest v0.3.0
+	github.com/docker/attest v0.3.1
 	github.com/google/go-containerregistry v0.20.1
 	github.com/in-toto/in-toto-golang v0.9.0
 	github.com/open-policy-agent/frameworks/constraint v0.0.0-20221214024800-b745745c4118
diff --git a/go.sum b/go.sum
index 9d8774b..ac4c461 100644
--- a/go.sum
+++ b/go.sum
@@ -212,8 +212,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/attest v0.3.0 h1:rXLcq5QEFeePwFzJjcNZYS1ePhpzXktRIVEn/rvA0co=
-github.com/docker/attest v0.3.0/go.mod h1:UuJ+jXWrCep9HDnWocjxD2fgyWisqCZ3kgQSJ+wOJyc=
+github.com/docker/attest v0.3.1 h1:cRxXrDPAngWVhhfmTGLOxY+zql4fgyJUVz58bqhAk+k=
+github.com/docker/attest v0.3.1/go.mod h1:UuJ+jXWrCep9HDnWocjxD2fgyWisqCZ3kgQSJ+wOJyc=
 github.com/docker/cli v27.1.1+incompatible h1:goaZxOqs4QKxznZjjBWKONQci/MywhtRv2oNn0GkeZE=
 github.com/docker/cli v27.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=