diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42c1c44eb55fd..f7c6eb44ae21a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -231,6 +231,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write # for build provenance signing
+      attestations: write # to record the attestation
     steps:
       - name: Download binary artifacts
         uses: actions/download-artifact@v4
@@ -245,6 +247,11 @@ jobs:
           name: checksums
           path: artifacts
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-path: artifacts/*
+
       - name: Publish release assets
         uses: softprops/action-gh-release@v2
         with: