diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17b9eaa..14b82de 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -207,12 +207,22 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: read
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.2.2
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@0b1efabc08b657293548b77fb76cc02d26091c7e # stable
 
+      - name: Package crate
+        run: cargo package
+
+      - name: Attest crate provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: 'target/package/*.crate'
+
       - name: Publish to crates.io
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}