diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml
index 2f733b9..0cf0219 100644
--- a/.github/workflows/incluster-comp-pr-merged.yaml
+++ b/.github/workflows/incluster-comp-pr-merged.yaml
@@ -128,6 +128,7 @@ jobs:
             packages: write
             contents: read
             pull-requests: read
+            attestations: write
 
         steps:
             # - name: Exit if not on master branch
@@ -167,6 +168,7 @@ jobs:
                   password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
 
             - name: Build and push
+              id: build
               uses: docker/build-push-action@v6
               with:
                   context: .
@@ -178,6 +180,13 @@ jobs:
                   cache-to: type=gha,mode=max
                   push: true
 
+            - name: Attest image provenance
+              uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+              with:
+                  subject-name: ${{ inputs.IMAGE_NAME }}
+                  subject-digest: ${{ steps.build.outputs.digest }}
+                  push-to-registry: true
+
             - name: Install cosign
               uses: sigstore/cosign-installer@main
               with: