diff --git a/.github/workflows/CICD.yml b/.github/workflows/CICD.yml
index c1343561..5848205f 100644
--- a/.github/workflows/CICD.yml
+++ b/.github/workflows/CICD.yml
@@ -13,6 +13,11 @@ on:
     tags:
       - '*'
 
+permissions:
+  id-token: write
+  contents: write
+  attestations: write
+
 jobs:
   crate_metadata:
     name: Extract crate metadata
@@ -223,12 +228,14 @@ jobs:
         BIN_PATH: ${{ steps.bin.outputs.BIN_PATH }}
 
     - name: "Artifact upload: tarball"
+      id: upload-tarball
       uses: actions/upload-artifact@master
       with:
         name: ${{ steps.package.outputs.PKG_NAME }}
         path: ${{ steps.package.outputs.PKG_PATH }}
 
     - name: "Artifact upload: Debian package"
+      id: upload-deb
       uses: actions/upload-artifact@master
       if: steps.debian-package.outputs.DPKG_NAME
       with:
@@ -242,6 +249,20 @@ jobs:
         unset IS_RELEASE ; if [[ $GITHUB_REF =~ ^refs/tags/v[0-9].* ]]; then IS_RELEASE='true' ; fi
         echo "IS_RELEASE=${IS_RELEASE}" >> $GITHUB_OUTPUT
 
+    - name: "Attest artifact: tarball"
+      uses: actions/attest-build-provenance@v3
+      if: steps.is-release.outputs.IS_RELEASE
+      with:
+        subject-name: ${{ steps.package.outputs.PKG_NAME }}
+        subject-digest: sha256::${{ steps.upload-tarball.artifact-digest }}
+
+    - name: "Attest artifact: Debian package"
+      uses: actions/attest-build-provenance@v3
+      if: 'steps.is-release.outputs.IS_RELEASE && steps.debian-package.outputs.DPKG_NAME'
+      with:
+        subject-name: ${{ steps.debian-package.outputs.DPKG_NAME }}
+        subject-digest: sha256::${{ steps.upload-deb.outputs.artifact-digest }}
+
     - name: Publish archives and packages
       uses: softprops/action-gh-release@v2
       if: steps.is-release.outputs.IS_RELEASE