diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a4509c6b..c6d0b936 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -234,6 +234,7 @@ jobs:
       url: https://pypi.org/p/cmake
     permissions:
       id-token: write
+      attestations: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -241,4 +242,9 @@ jobs:
           merge-multiple: true
           path: dist
 
+      - name: Generate artifact attestation for sdist and wheel
+        uses: actions/attest-build-provenance@bdd51370e0416ac948727f861e03c2f05d32d78e # v1.3.2
+        with:
+          subject-path: "dist/cmake-*"
+
       - uses: pypa/gh-action-pypi-publish@release/v1