diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9683fc6d..b93d4757 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -37,6 +37,11 @@ jobs:
       - name: Perform npm tasks
         run: npm run ci
 
+      - name: Generate signed attestations for workflow artifacts
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/bin/**/run-matlab-command*
+
       # Finally, create a detached commit containing the built artifacts and tag
       # it with the release. Note: the fact that the branch is locally updated
       # will not be relayed (pushed) to origin
diff --git a/package-lock.json b/package-lock.json
index 2e9853d6..aa7d72c6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5185,9 +5185,9 @@
             }
         },
         "node_modules/ws": {
-            "version": "8.20.0",
-            "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
-            "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
+            "version": "8.20.1",
+            "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
+            "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
             "dev": true,
             "license": "MIT",
             "engines": {