diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9683fc6..77070d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,9 @@ on:
     types: published
 permissions:
   contents: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
 
 jobs:
   build:
@@ -37,6 +40,11 @@ jobs:
       - name: Perform npm tasks
         run: npm run ci
 
+      - name: Generate signed attestations for workflow artifacts
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/bin/**/run-matlab-command*
+
       # Finally, create a detached commit containing the built artifacts and tag
       # it with the release. Note: the fact that the branch is locally updated
       # will not be relayed (pushed) to origin