diff --git a/.github/scripts/microvm-ci-release_test.sh b/.github/scripts/microvm-ci-release_test.sh
index 16b2f18029..b3dfe3c71e 100644
--- a/.github/scripts/microvm-ci-release_test.sh
+++ b/.github/scripts/microvm-ci-release_test.sh
@@ -478,10 +478,10 @@ COSIGN_PASSWORD= MICROVM_RELEASE_SIGNING_KEY="$scratch/publisher.key" "$sign" "$
 for kind in runtime firmware execution-image; do
   statement="$scratch/one/mecatl-$kind-linux-amd64.provenance.json"
   bundle="$scratch/one/mecatl-$kind-linux-amd64.provenance.sigstore.json"
-  cosign verify-blob --key "$scratch/publisher.pub" --bundle "$bundle" "$statement" >/dev/null
+  cosign verify-blob --key "$scratch/publisher.pub" --insecure-ignore-tlog --bundle "$bundle" "$statement" >/dev/null
   cp "$statement" "$scratch/tampered.provenance.json"
   printf ' ' >>"$scratch/tampered.provenance.json"
-  if cosign verify-blob --key "$scratch/publisher.pub" --bundle "$bundle" "$scratch/tampered.provenance.json" >/dev/null 2>&1; then
+  if cosign verify-blob --key "$scratch/publisher.pub" --insecure-ignore-tlog --bundle "$bundle" "$scratch/tampered.provenance.json" >/dev/null 2>&1; then
     echo "tampered $kind publisher evidence was accepted" >&2
     exit 1
   fi
diff --git a/.github/scripts/sign-microvm-release-evidence.sh b/.github/scripts/sign-microvm-release-evidence.sh
index d73d628f28..157c81d684 100755
--- a/.github/scripts/sign-microvm-release-evidence.sh
+++ b/.github/scripts/sign-microvm-release-evidence.sh
@@ -31,7 +31,9 @@ for provenance in "$assets"/*.provenance.json; do
       --bundle "$bundle" "$provenance" >/dev/null
     echo "Reusing verified signature bundle $(basename "$bundle")"
   elif [ -n "${MICROVM_RELEASE_SIGNING_KEY:-}" ]; then
-    COSIGN_PASSWORD=${COSIGN_PASSWORD:-} cosign sign-blob --yes --key "$MICROVM_RELEASE_SIGNING_KEY" --bundle "$bundle" "$provenance"
+    # A throwaway test key: keep its signature out of the public Rekor log. The
+    # upload is worthless here and a retried POST can come back as a 409 conflict.
+    COSIGN_PASSWORD=${COSIGN_PASSWORD:-} cosign sign-blob --yes --use-signing-config=false --tlog-upload=false --key "$MICROVM_RELEASE_SIGNING_KEY" --bundle "$bundle" "$provenance"
   else
     cosign sign-blob --yes --bundle "$bundle" "$provenance"
   fi