diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b995054c3e..975b6868270 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -146,6 +146,29 @@ jobs:
     outputs:
       artifact-id: ${{ steps.publish-artifacts-step.outputs.artifact-id }}
 
+  attest-artifacts:
+    name: "Attest Artifacts"
+    needs: ["build-and-validate"]
+    if: ${{ github.event_name == 'workflow_dispatch' }}
+    runs-on: "ubuntu-latest"
+    permissions:
+      id-token: "write"
+      contents: "read"
+      attestations: "write"
+    steps:
+      - name: "Download Artifacts"
+        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1
+        with:
+          artifact-ids: ${{ needs.build-and-validate.outputs.artifact-id }}
+
+      - name: "Generate artifact attestations"
+        uses: "actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26" # v4.1.0
+        with:
+          subject-path: |
+            *.nupkg
+            *.snupkg
+            *.zip
+
   deploy-to-nuget:
     name: "Deploy to NuGet"
     needs: ["build-and-validate"]