diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 52919860..3e23254f 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -6,6 +6,8 @@ on:
 permissions:
   pull-requests: write
   contents: write
+  id-token: write
+  attestations: write
 jobs:
   release-plz:
     name: Release-plz
@@ -25,4 +27,7 @@ jobs:
         uses: MarcoIeni/release-plz-action@v0.5
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_PAT }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
\ No newline at end of file
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: target/release/libzip.rlib