diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 674a4f7b..89799bb1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,12 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # Declaring permissions replaces the defaults entirely, so contents: write
+    # has to be listed for the GitHub release. id-token: write mints the OIDC
+    # token cosign exchanges for a short-lived signing certificate.
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Code checkout
         uses: actions/checkout@v5
@@ -36,6 +42,8 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: 1.26.5
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
diff --git a/Makefile b/Makefile
index a71f226d..fa3b8e59 100644
--- a/Makefile
+++ b/Makefile
@@ -17,7 +17,7 @@ build:
 	@echo "Binaries built in ./bin/"
 
 build/goreleaser:
-	goreleaser release -f ./build/.goreleaser.yaml --snapshot --clean
+	goreleaser release -f ./build/.goreleaser.yaml --snapshot --clean --skip=sign
 
 build/outpost:
 	go build -o bin/outpost ./cmd/outpost
@@ -144,7 +144,7 @@ logs:
 # Use docker/push to push to Docker Hub: DOCKER_USER=<your-username> make docker/push TAG=v0.13.3-beta
 docker/build:
 	@if [ -z "$(TAG)" ]; then echo "Usage: make docker/build TAG=v0.13.3-beta"; exit 1; fi
-	GORELEASER_CURRENT_TAG=$(TAG) goreleaser release -f ./build/.goreleaser.yaml --snapshot --clean
+	GORELEASER_CURRENT_TAG=$(TAG) goreleaser release -f ./build/.goreleaser.yaml --snapshot --clean --skip=sign
 
 # Tag and push image to Docker Hub under DOCKER_USER (e.g. make docker/push DOCKER_USER=alexbouchard TAG=v0.13.3-beta).
 # Requires: docker login first.
diff --git a/build/.goreleaser.yaml b/build/.goreleaser.yaml
index ff4ecc9e..bf84c284 100644
--- a/build/.goreleaser.yaml
+++ b/build/.goreleaser.yaml
@@ -104,12 +104,10 @@ dockers_v2:
     platforms:
       - linux/amd64
       - linux/arm64
-    # No attestations, so the manifest keeps the same two platform entries as
-    # today. Takes both switches — buildx adds provenance on its own.
-    sbom: false
+    # Publishes an SBOM attestation; buildx adds provenance on its own.
+    sbom: true
     flags:
       - "--pull"
-      - "--provenance=false"
     labels:
       org.opencontainers.image.created: "{{ .Date }}"
       org.opencontainers.image.name: "{{ .ProjectName }}"
@@ -117,3 +115,18 @@ dockers_v2:
       org.opencontainers.image.version: "{{ .Version }}"
       repository: "https://github.com/hookdeck/outpost"
       homepage: "https://hookdeck.com"
+
+# Signs checksums.txt, which covers every archive transitively. This one runs
+# before publish, so local snapshot builds pass --skip=sign to avoid needing
+# cosign installed.
+signs:
+  - cmd: cosign
+    signature: "${artifact}.sigstore.json"
+    artifacts: checksum
+    args: ["sign-blob", "--bundle=${signature}", "${artifact}", "--yes"]
+
+# Keyless cosign signing via the workflow's OIDC token. Omitting --key is what
+# selects keyless; publish-phase only, so --snapshot never invokes cosign.
+docker_signs:
+  - artifacts: images
+    args: ["sign", "${artifact}@${digest}", "--yes"]