diff --git a/.github/workflows/ci-linux-artifacts.yml b/.github/workflows/ci-linux-artifacts.yml
index 8d54bb844e..c0b567d52d 100644
--- a/.github/workflows/ci-linux-artifacts.yml
+++ b/.github/workflows/ci-linux-artifacts.yml
@@ -7,6 +7,9 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
+  # artifact-metadata is not needed because push-to-registry is not enabled.
 
 jobs:
   build-linux-artifacts:
@@ -49,6 +52,11 @@ jobs:
             avifenc
             avifdec
             avifgainmaputil
+      - name: Attest artifacts
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: build/linux-artifacts.zip
+
       - name: Upload artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-macos-artifacts.yml b/.github/workflows/ci-macos-artifacts.yml
index 98ede18b6e..33bb607e5c 100644
--- a/.github/workflows/ci-macos-artifacts.yml
+++ b/.github/workflows/ci-macos-artifacts.yml
@@ -7,6 +7,9 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
+  # artifact-metadata is not needed because push-to-registry is not enabled.
 
 jobs:
   build-macos-artifacts:
@@ -60,6 +63,11 @@ jobs:
             avifdec
             avifgainmaputil
             README.txt
+      - name: Attest artifacts
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: build/${{ runner.os }}-artifacts.zip
+
       - name: Upload artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci-windows-artifacts.yml b/.github/workflows/ci-windows-artifacts.yml
index 99a19bc51c..63c5861ff8 100644
--- a/.github/workflows/ci-windows-artifacts.yml
+++ b/.github/workflows/ci-windows-artifacts.yml
@@ -7,6 +7,9 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
+  # artifact-metadata is not needed because push-to-registry is not enabled.
 
 jobs:
   build-windows-artifacts:
@@ -80,6 +83,11 @@ jobs:
           filename: "windows-artifacts.zip"
           directory: "build/Release"
           path: "*.exe"
+      - name: Attest artifacts
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: build/Release/windows-artifacts.zip
+
       - name: Upload artifacts
         shell: pwsh
         env: