diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 5151234..32fb1b7 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -47,8 +47,6 @@ jobs:
       # so use GitHub's runners instead of Canonical's self-hosted runners.
       arch-map: '{"amd64":["ubuntu-24.04"],"arm64":["ubuntu-24.04-arm"]}'
       rockcraft-test: ${{ matrix.run-tests }}
-    secrets:
-      source-github-token: ${{ secrets.REPO_CLONER_TOKEN }}
 
   test:
     needs: [prepare, build]
@@ -59,53 +57,38 @@ jobs:
     with:
       oci-archive-name: ${{ matrix.artifact-name }}
 
-  attest-and-scan:
+  attest:
     needs: [prepare, test]
     runs-on: ubuntu-latest
     strategy:
-      matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
       fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.prepare.outputs.build-matrix).include }}
+        arch: [amd64, arm64]
     permissions:
       contents: read
       id-token: write
       attestations: write
       artifact-metadata: write
     steps:
-      - name: Download rock artifact
+      - name: Download per-arch rock artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
-          name: ${{ matrix.artifact-name }}
+          pattern: ${{ matrix.artifact-name }}-${{ matrix.name }}_*_${{ matrix.arch }}.rock
           path: ./rock
+          merge-multiple: true
 
-      - name: Generate SBOM (Syft)
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
-        with:
-          image: oci-archive:./rock/${{ matrix.artifact-name }}
-          format: spdx-json
-          output-file: ./sbom.spdx.json
-          upload-artifact: false
-          upload-release-assets: false
+      - name: Locate rock file
+        id: rock
+        run: echo "path=$(ls ./rock/${{ matrix.name }}_*_${{ matrix.arch }}.rock)" >> "$GITHUB_OUTPUT"
 
       - name: Attest build provenance
         uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
         with:
-          subject-path: ./rock/${{ matrix.artifact-name }}
-
-      - name: Attest SBOM
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
-        with:
-          subject-path: ./rock/${{ matrix.artifact-name }}
-          sbom-path: ./sbom.spdx.json
-
-      - name: Scan rock (Grype)
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
-        with:
-          sbom: ./sbom.spdx.json
-          fail-build: true
-          severity-cutoff: high
+          subject-path: ${{ steps.rock.outputs.path }}
 
   upload-ghcr:
-    needs: [prepare, attest-and-scan]
+    needs: [prepare, attest]
     runs-on: ubuntu-latest
     strategy:
       matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}