diff --git a/go.mod b/go.mod
index 57de94d70..7feea0685 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,8 @@ require (
 	sigs.k8s.io/release-utils v0.7.7
 )
 
-replace github.com/sigstore/sigstore-go => ../sigstore-go
+// use the pending PR #41 branch tuf-client-2
+replace github.com/sigstore/sigstore-go => github.com/sigstore/sigstore-go v0.0.0-20231222133331-d489b534902f
 
 require (
 	filippo.io/edwards25519 v1.1.0 // indirect
diff --git a/go.sum b/go.sum
index c33942e5c..f43f3e134 100644
--- a/go.sum
+++ b/go.sum
@@ -648,6 +648,8 @@ github.com/sigstore/rekor v1.3.4 h1:RGIia1iOZU7fOiiP2UY/WFYhhp50S5aUm7YrM8aiA6E=
 github.com/sigstore/rekor v1.3.4/go.mod h1:1GubPVO2yO+K0m0wt/3SHFqnilr/hWbsjSOe7Vzxrlg=
 github.com/sigstore/sigstore v1.8.0 h1:sSRWXv1JiDsK4T2wNWVYcvKCgxcSrhQ/QUJxsfCO4OM=
 github.com/sigstore/sigstore v1.8.0/go.mod h1:l12B1gFlLIpBIVeqk/q1Lb+6YSOGNuN3xLExIjYH+qc=
+github.com/sigstore/sigstore-go v0.0.0-20231222133331-d489b534902f h1:XU1uVdfcqsTZh/35uRvzvLQ2UuQIfzpf4aGr5HIqf+U=
+github.com/sigstore/sigstore-go v0.0.0-20231222133331-d489b534902f/go.mod h1:lZElyhZDR1G4cxriCN+OLOd4EF4T0PWuFdIsGSNbN+E=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.0 h1:nLaaOX85YjBKQOQHWY2UlDkbx+je8ozTEM+t1ySAb78=
 github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.0/go.mod h1:fLxrKqPP9lIz/B3UBD4ZK6j6984eX2czu/0zxm99fkE=
 github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.0 h1:Txd7Fjei2NVb/sjBNYybrl+FcZGptO6FXXH4pVNBQMs=