diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7427c02..5a713c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,9 @@
 name: Build precompiled NIFs
 
+permissions:
+  id-token: write
+  attestations: write
+
 on:
   push:
     branches:
@@ -66,6 +70,11 @@ jobs:
         use-cross: ${{ matrix.job.use-cross }}
         project-dir: "native/html5ever_nif"
 
+    - name: Artifact attestation
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: ${{ steps.build-crate.outputs.file-path }}
+
     - name: Artifact upload
       uses: actions/upload-artifact@v4
       with: