diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 29abeba..40edf79 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -59,9 +59,54 @@ jobs:
     with:
       oci-archive-name: ${{ matrix.artifact-name }}
 
-  upload-ghcr:
+  attest-and-scan:
     needs: [prepare, test]
     runs-on: ubuntu-latest
+    strategy:
+      matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
+      fail-fast: false
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    steps:
+      - name: Download rock artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: ${{ matrix.artifact-name }}
+          path: ./rock
+
+      - name: Generate SBOM (Syft)
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          image: oci-archive:./rock/${{ matrix.artifact-name }}
+          format: spdx-json
+          output-file: ./sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest build provenance
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        with:
+          subject-path: ./rock/${{ matrix.artifact-name }}
+
+      - name: Attest SBOM
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        with:
+          subject-path: ./rock/${{ matrix.artifact-name }}
+          sbom-path: ./sbom.spdx.json
+
+      - name: Scan rock (Grype)
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
+        with:
+          sbom: ./sbom.spdx.json
+          fail-build: true
+          severity-cutoff: high
+
+  upload-ghcr:
+    needs: [prepare, attest-and-scan]
+    runs-on: ubuntu-latest
     strategy:
       matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
       fail-fast: false
diff --git a/pyproject.toml b/pyproject.toml
index 31a3db4..96aa96c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "api_demo_server"
-version = "2.1.0"
+version = "2.1.1"
 description = "FastAPI demo server"
 authors = [
     { name = "The Charm Tech team at Canonical Ltd." },
diff --git a/rockcraft.yaml b/rockcraft.yaml
index 8fba609..35d0907 100644
--- a/rockcraft.yaml
+++ b/rockcraft.yaml
@@ -2,7 +2,7 @@ name: api-demo-server
 base: bare
 build-base: ubuntu@24.04
 run-user: _daemon_
-version: "2.1.0"
+version: "2.1.1"
 summary: FastAPI demo server
 description: A web server that can be integrated with a PostgreSQL database.
 license: Apache-2.0