diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44facef0f9f..3904435ea82 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
 permissions:
   contents: write
   actions: write
+  id-token: write # for build provenance signing
+  attestations: write # to record the attestation
 
 jobs:
   release:
@@ -27,6 +29,13 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-path: |
+            dist/*.tar.gz
+            dist/*.zip
+            dist/checksums.txt
       - name: Winget
         uses: vedantmgoyal2009/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with: