diff --git a/checks/fileparser/github_workflow.go b/checks/fileparser/github_workflow.go
index 09c207b7047..6c7f6f7b8fb 100644
--- a/checks/fileparser/github_workflow.go
+++ b/checks/fileparser/github_workflow.go
@@ -573,10 +573,20 @@ func IsPackagingWorkflow(workflow *actionlint.Workflow, fp string) (JobMatchResu
 		},
 		{
 			// Ko container action. https://github.com/google/ko
+			// The action was renamed from imjasonh/setup-ko to ko-build/setup-ko,
+			// so both spellings need their own single-step matcher: JobMatcher
+			// requires every listed step to match, and a workflow uses only one
+			// of them. See https://github.com/ossf/scorecard/issues/5133.
 			Steps: []*JobMatcherStep{
 				{
 					Uses: "imjasonh/setup-ko",
 				},
+			},
+			LogText: "candidate container publishing workflow using ko",
+		},
+		{
+			// Ko container action. https://github.com/google/ko
+			Steps: []*JobMatcherStep{
 				{
 					Uses: "ko-build/setup-ko",
 				},
diff --git a/checks/fileparser/github_workflow_test.go b/checks/fileparser/github_workflow_test.go
index 0cc09de7445..304b843bbb8 100644
--- a/checks/fileparser/github_workflow_test.go
+++ b/checks/fileparser/github_workflow_test.go
@@ -984,6 +984,16 @@ func TestIsPackagingWorkflow(t *testing.T) {
 			filename: "../testdata/.github/workflows/github-workflow-packaging-go.yaml",
 			expected: true,
 		},
+		{
+			name:     "ko publish (renamed action)",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-ko-renamed-action.yaml",
+			expected: true,
+		},
+		{
+			name:     "ko publish (legacy action)",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-ko-legacy-action.yaml",
+			expected: true,
+		},
 		{
 			name:     "cargo publish",
 			filename: "../testdata/.github/workflows/github-workflow-packaging-cargo.yaml",
diff --git a/checks/testdata/.github/workflows/github-workflow-packaging-ko-legacy-action.yaml b/checks/testdata/.github/workflows/github-workflow-packaging-ko-legacy-action.yaml
new file mode 100644
index 00000000000..b6d18d3f978
--- /dev/null
+++ b/checks/testdata/.github/workflows/github-workflow-packaging-ko-legacy-action.yaml
@@ -0,0 +1,27 @@
+# Copyright 2026 OpenSSF Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: ko publish (legacy action)
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: imjasonh/setup-ko@v0.6
+      - run: ko build ./
diff --git a/checks/testdata/.github/workflows/github-workflow-packaging-ko-renamed-action.yaml b/checks/testdata/.github/workflows/github-workflow-packaging-ko-renamed-action.yaml
new file mode 100644
index 00000000000..67172b1f3c6
--- /dev/null
+++ b/checks/testdata/.github/workflows/github-workflow-packaging-ko-renamed-action.yaml
@@ -0,0 +1,27 @@
+# Copyright 2026 OpenSSF Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: ko publish
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ko-build/setup-ko@v0.6
+      - run: ko build ./