diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c98f460..4133725 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -7,7 +7,9 @@ on:
             - "debug-*" # Also run on non-release debugging
 
 permissions:
-    contents: write # This gives permission to create releases
+    contents: write
+    id-token: write
+    attestations: write
 
 jobs:
     build:
@@ -36,6 +38,12 @@ jobs:
             - name: Build plugin
               run: bun run build
 
+            - name: Attest build provenance
+              if: ${{ !startsWith(github.ref_name, 'debug-') }}
+              uses: actions/attest-build-provenance@v2
+              with:
+                  subject-path: main.js
+
             - name: Verify versions match
               run: |
                   # Check if tag version matches package.json, manifest.json and exists in versions.json
diff --git a/.gitignore b/.gitignore
index d83243c..051348d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,5 +19,4 @@ main.js
 data.json
 
 # Exclude macOS Finder (System Explorer) View States
-.DS_Store
-bun.lockb
+.DS_Store
diff --git a/bun.lock b/bun.lock
index cfd3a2f..52accc2 100644
--- a/bun.lock
+++ b/bun.lock
@@ -5,7 +5,7 @@
     "": {
       "name": "inboxer",
       "dependencies": {
-        "@types/jest": "^29.5.14",
+        "@types/jest": "29.5.14",
       },
       "devDependencies": {
         "@types/bun": "1.2.9",