diff --git a/docs/DEVELOPMENT-AND-BUILD-RULES.md b/docs/DEVELOPMENT-AND-BUILD-RULES.md
index acf9885..d0c293d 100644
--- a/docs/DEVELOPMENT-AND-BUILD-RULES.md
+++ b/docs/DEVELOPMENT-AND-BUILD-RULES.md
@@ -545,10 +545,20 @@ org.opencontainers.image.source    = https://github.com/dmfdeploy/dmf-cms
 `docker inspect <image>` exposes them; useful for forensics when a pod is on
 a tag you don't recognize.
 
-### Signing (deferred)
-
-Cosign signing is not yet wired. When it is, `build-image.sh` gains a `cosign sign`
-step after `docker push` and the cluster gates pulls on a verified signature.
+### Provenance and signing
+
+Every release that the release workflow above publishes carries a GitHub
+build-provenance attestation on its index digest. It is a signed record of the
+workflow, commit and repository that built that digest. The first attested release
+is 0.40.1; 0.39.0 and earlier were published before the workflow and have no
+attestation. To check a release from 0.40.1 on, run
+`gh attestation verify oci://ghcr.io/dmfdeploy/dmf-cms:<VERSION> --repo dmfdeploy/dmf-cms`.
+
+The cluster does not check signatures or attestations when it pulls an image. A
+separate cosign signature would add nothing until something enforces it, so the
+release does not sign with cosign. For a lane that must refuse unverified images,
+both stay open: a cosign signature, and an admission policy that checks the
+signature or the attestation at pull time.
 
 ---