diff --git a/.github/workflows/docker-publish.yaml b/.github/workflows/docker-publish.yaml
index 98c1c24..b68b4cf 100644
--- a/.github/workflows/docker-publish.yaml
+++ b/.github/workflows/docker-publish.yaml
@@ -47,12 +47,10 @@ jobs:
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
-      - name: Install cosign
-        if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3.1.1
         with:
-          cosign-release: 'v1.13.1'
-
+          cosign-release: 'v2.1.1'
 
       # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
diff --git a/internal/ci/conductor_hcl.go b/internal/ci/conductor_hcl.go
index a4d83ed..107927d 100644
--- a/internal/ci/conductor_hcl.go
+++ b/internal/ci/conductor_hcl.go
@@ -151,7 +151,8 @@ func CreateEvalContext(cfg ConductorConfig, process Process) *hcl.EvalContext {
 			"yamlencode": yaml.YAMLEncodeFunc,
 			"zipmap":     stdlib.ZipmapFunc,
 
-			"stripansi": ui.StripAnsiFunc,
+			"stripansi":   ui.StripAnsiFunc,
+			"shellescape": ui.ShellEscapeFunc,
 
 			"ansifmt": ui.AnsiFunc,
 			"env": function.New(&function.Spec{
diff --git a/internal/ui/colors.go b/internal/ui/colors.go
index 9c5233d..7c1f014 100644
--- a/internal/ui/colors.go
+++ b/internal/ui/colors.go
@@ -3,6 +3,7 @@ package ui
 import (
 	"fmt"
 	"github.com/acarl005/stripansi"
+	"github.com/alessio/shellescape"
 	"github.com/fatih/color"
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/function"
@@ -76,6 +77,20 @@ var StripAnsiFunc = function.New(&function.Spec{
 	},
 })
 
+var ShellEscapeFunc = function.New(&function.Spec{
+	Params: []function.Parameter{
+		{
+			Name: "message",
+			Type: cty.String,
+		},
+	},
+	Type: function.StaticReturnType(cty.String),
+	Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) {
+		message := args[0].AsString()
+		return cty.StringVal(shellescape.Quote(message)), nil
+	},
+})
+
 func Color(color string, message string) string {
 	switch color {
 	case "green":