diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bc8bbc35..94649e60d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,10 @@ name: Release tarball
 
 on: [workflow_dispatch]
 
+permissions:
+  id-token: write
+  attestations: write
+
 env:
   OPAMVERBOSE: 1
 
@@ -109,6 +113,10 @@ jobs:
         eval $(opam env)
         make tarball TARBALL_EXTRA_BIN=$(which z3)
 
+    - uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: _build/sail.tar.gz
+
     - name: Upload tarball
       uses: actions/upload-artifact@v4
       with: