diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1b67bc0..7cd62b4b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,8 @@ on:
 # We need this to be able to create releases.
 permissions:
   contents: write
+  id-token: write # for build provenance signing
+  attestations: write # to record the attestation
 
 jobs:
   # The create-release job runs purely to initialize the GitHub release itself,
@@ -282,6 +284,11 @@ jobs:
         echo "ASSET=$ARCHIVE.tar.gz" >> $GITHUB_ENV
         echo "ASSET_SUM=$ARCHIVE.tar.gz.sha256" >> $GITHUB_ENV
 
+    - name: Attest build provenance
+      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+      with:
+        subject-path: ${{ env.ASSET }}
+
     - name: Upload release archive
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}