diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1692f1b..90214fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -28,6 +30,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: |
+            dist/omni_*.tar.gz
+            dist/omni_*.zip
+            dist/checksums.txt
+
       - name: Checkout Homebrew tap
         if: ${{ !contains(github.ref_name, '-') }}
         uses: actions/checkout@v4
diff --git a/README.md b/README.md
index 44a6a64..8de96a8 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,16 @@ Pre-built binaries for macOS, Linux, and Windows are available on the [Releases
 | Linux    | amd64, arm64  |
 | Windows  | amd64         |
 
+### Verifying release artifacts
+
+Release archives and `checksums.txt` are signed with [GitHub Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) (Sigstore under the hood). The install script and Homebrew formula already verify SHA-256 checksums; attestations let you additionally prove the artifact was built by this repo's `release.yml` workflow.
+
+Verify a downloaded archive with the GitHub CLI:
+
+```bash
+gh attestation verify omni_1.2.3_linux_amd64.tar.gz --repo exploreomni/cli
+```
+
 ### Build from source
 
 ```bash