diff --git a/template/.github/workflows/build.yaml.j2 b/template/.github/workflows/build.yaml.j2
index ac52870f..e0fb3d90 100644
--- a/template/.github/workflows/build.yaml.j2
+++ b/template/.github/workflows/build.yaml.j2
@@ -205,9 +205,6 @@ jobs:
     permissions:
       id-token: write
     runs-on: ubuntu-latest
-    outputs:
-      oci-index-digest: ${{ steps.publish-oci.outputs.image-index-manifest-digest }}
-      quay-index-digest: ${{ steps.publish-quay.outputs.image-index-manifest-digest }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -215,7 +212,6 @@ jobs:
           persist-credentials: false
 
       - name: Publish and Sign Image Index to oci.stackable.tech
-        id: publish-oci
         uses: stackabletech/actions/publish-image-index-manifest@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3
         with:
           image-registry-uri: oci.stackable.tech
@@ -225,7 +221,6 @@ jobs:
           image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
 
       - name: Publish and Sign Image Index to quay.io
-        id: publish-quay
         uses: stackabletech/actions/publish-image-index-manifest@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3
         with:
           image-registry-uri: quay.io
@@ -234,64 +229,6 @@ jobs:
           image-repository: stackable/sdp/${{ env.OPERATOR_NAME }}
           image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
 
-  # Generate SLSA build provenance for the multi-arch image index and attach it
-  # to the published image in each registry. The reusable workflow signs the
-  # provenance with keyless signing (GitHub Actions as the OIDC identity) and
-  # pushes the attestation next to the image.
-  provenance-oci:
-    name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (oci.stackable.tech)
-    if: |
-      (github.event_name != 'merge_group')
-      && needs.detect-changes.outputs.detected == 'true'
-      && !github.event.pull_request.head.repo.fork
-    needs:
-      - detect-changes
-      - build-container-image
-      - publish-index-manifest
-    permissions:
-      actions: read # detect the build workflow that generated the image
-      id-token: write # mint the OIDC token for keyless signing
-      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
-    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
-    # workflow cannot verify its own provenance.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
-    with:
-      # The 'env' context is not available in job-level 'with' inputs of
-      # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME
-      # can't be used here and the operator name is templated in directly.
-      image: oci.stackable.tech/sdp/{[ operator.name }]
-      digest: ${{ needs.publish-index-manifest.outputs.oci-index-digest }}
-      registry-username: robot$sdp+github-action-build
-    secrets:
-      registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
-
-  provenance-quay:
-    name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (quay.io)
-    if: |
-      (github.event_name != 'merge_group')
-      && needs.detect-changes.outputs.detected == 'true'
-      && !github.event.pull_request.head.repo.fork
-    needs:
-      - detect-changes
-      - build-container-image
-      - publish-index-manifest
-    permissions:
-      actions: read # detect the build workflow that generated the image
-      id-token: write # mint the OIDC token for keyless signing
-      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
-    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
-    # workflow cannot verify its own provenance.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
-    with:
-      # The 'env' context is not available in job-level 'with' inputs of
-      # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME
-      # can't be used here and the operator name is templated in directly.
-      image: quay.io/stackable/sdp/{[ operator.name }]
-      digest: ${{ needs.publish-index-manifest.outputs.quay-index-digest }}
-      registry-username: stackable+robot_sdp_github_action_build
-    secrets:
-      registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
-
   publish-helm-chart:
     name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
     if: |
@@ -386,8 +323,6 @@ jobs:
       - cargo-udeps
       - build-container-image
       - publish-index-manifest
-      - provenance-oci
-      - provenance-quay
       - publish-helm-chart
       - openshift-preflight-check
     runs-on: ubuntu-latest
@@ -419,8 +354,6 @@ jobs:
       - detect-changes
       - build-container-image
       - publish-index-manifest
-      - provenance-oci
-      - provenance-quay
       - publish-helm-chart
     runs-on: ubuntu-latest
     steps:
@@ -435,15 +368,6 @@ jobs:
           publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
           publish-manifests-result: ${{ needs.publish-index-manifest.result }}
           build-result: ${{ needs.build-container-image.result }}
-          # Provenance is generated per registry, but the notification only has a
-          # single field for it, so the two results are collapsed into the worst
-          # one. 'failure' must be reported verbatim, otherwise the notification
-          # is not marked as failed.
-          generate-provenance-result: >-
-            ${{ (needs.provenance-oci.result == 'failure' || needs.provenance-quay.result == 'failure') && 'failure'
-            || (needs.provenance-oci.result == 'cancelled' || needs.provenance-quay.result == 'cancelled') && 'cancelled'
-            || (needs.provenance-oci.result == 'skipped' || needs.provenance-quay.result == 'skipped') && 'skipped'
-            || 'success' }}
           slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
           channel-id: C07UG6JH44F # notifications-container-images
           type: container-image-build