diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 60294b1..ded8438 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -41,6 +43,13 @@ jobs:
         run: |
           node -e "const manifest=require('./manifest.json'); const tag=process.env.GITHUB_REF_NAME; if (manifest.version !== tag) { throw new Error(`manifest.json version ${manifest.version} does not match tag ${tag}`); }"
 
+      - name: Generate artifact attestations
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            main.js
+            styles.css
+
       - name: Create GitHub release
         uses: softprops/action-gh-release@v2
         with: