diff --git a/.github/setup/action.yml b/.github/setup/action.yml
index 588ba65..b30a8ee 100644
--- a/.github/setup/action.yml
+++ b/.github/setup/action.yml
@@ -3,6 +3,10 @@ description: Action that sets up Node, pnpm, and caching
 runs:
   using: composite
   steps:
+    - name: Check provenance
+      uses: danielroe/provenance-action@v0.1.1
+      with:
+        fail-on-downgrade: true
     - name: Setup pnpm
       uses: pnpm/action-setup@v4.1.0
     - name: Setup Node