@@ -20,6 +20,8 @@ import (
 	"os"
 	"strings"
 
+	"github.com/chainloop-dev/chainloop/app/cli/internal/repositoryconfig"
+	internaltoken "github.com/chainloop-dev/chainloop/app/cli/internal/token"
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter"
 	v1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
@@ -28,6 +30,15 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 )
 
+const (
+	attestationOrganizationNameAnnotation = "chainloop.attestation.organization"
+	attestationOrganizationFileAnnotation = "chainloop.attestation.organization-file"
+)
+
+var repositoryOrganizationCommands = map[string]bool{
+	"init": true, "add": true, "push": true, "status": true, "reset": true,
+}
+
 var (
 	useAttestationRemoteState bool
 	attestationLocalStatePath string
@@ -44,14 +55,8 @@ func newAttestationCmd() *cobra.Command {
 		Short:   "Craft Software Supply Chain Attestations",
 		Example: "Refer to https://docs.chainloop.dev/getting-started/attestation-crafting",
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-			// For non-init attestation subcommands using local state, load the org
-			// from the crafting state so the gRPC connection uses the correct org header.
-			// This handles the case where `init --org X` was used but subsequent commands
-			// would otherwise fall back to the default org from the config file.
-			if orgFlag := cmd.Root().PersistentFlags().Lookup(confOptions.organization.flagName); cmd.Name() != "init" && !useAttestationRemoteState && (orgFlag == nil || !orgFlag.Changed) {
-				if org := orgFromLocalState(attestationLocalStatePath); org != "" {
-					viper.Set(confOptions.organization.viperKey, org)
-				}
+			if err := resolveAttestationOrganization(cmd); err != nil {
+				return err
 			}
 
 			// run the initialization of the root command plus the new logic
@@ -84,6 +89,67 @@ func newAttestationCmd() *cobra.Command {
 	return cmd
 }
 
+func resolveAttestationOrganization(cmd *cobra.Command) error {
+	orgFlag := cmd.Root().PersistentFlags().Lookup(confOptions.organization.flagName)
+	explicitOrganization := (orgFlag != nil && orgFlag.Changed) || os.Getenv(CalculateEnvVarName(confOptions.organization.viperKey)) != ""
+	if explicitOrganization {
+		return nil
+	}
+
+	if repositoryOrganizationCommands[cmd.Name()] {
+		cfg, path, err := repositoryconfig.LoadChainloopYML(".")
+		if err == nil && cfg.Organization != "" {
+			authToken, _, err := loadAuthToken(cmd)
+			if err != nil {
+				return err
+			}
+			if tokenOrg, isAPI := internaltoken.APIOrganization(authToken); isAPI {
+				switch {
+				case tokenOrg == "":
+					return fmt.Errorf("API token does not identify its organization: create a new API token for %q or remove organization from %s", cfg.Organization, path)
+				case !strings.EqualFold(tokenOrg, cfg.Organization):
+					return fmt.Errorf("credentials belong to organization %q but %q is configured in %s: use an API token for %q or remove organization from %s", tokenOrg, cfg.Organization, path, cfg.Organization, path)
+				}
+			}
+
+			setAttestationOrganization(cmd, cfg.Organization, path)
+			if saved := viper.GetString(confOptions.organization.viperKey); saved != cfg.Organization {
+				logger.Info().Str("organization", cfg.Organization).Str("file", path).Msg("using organization from repository config")
+			}
+			return nil
+		}
+		if err != nil {
+			logger.Debug().Err(err).Msg("failed to load repository organization")
+		}
+	}
+
+	// Preserve the existing local-state fallback for commands other than init.
+	if cmd.Name() != "init" && !useAttestationRemoteState {
+		if org := orgFromLocalState(attestationLocalStatePath); org != "" {
+			setAttestationOrganization(cmd, org, "")
+		}
+	}
+
+	return nil
+}
+
+func setAttestationOrganization(cmd *cobra.Command, organization, path string) {
+	if cmd.Annotations == nil {
+		cmd.Annotations = make(map[string]string)
+	}
+	cmd.Annotations[attestationOrganizationNameAnnotation] = organization
+	if path != "" {
+		cmd.Annotations[attestationOrganizationFileAnnotation] = path
+	}
+}
+
+func attestationOrganization(cmd *cobra.Command) (organization, path string) {
+	if cmd == nil {
+		return "", ""
+	}
+	return cmd.Annotations[attestationOrganizationNameAnnotation], cmd.Annotations[attestationOrganizationFileAnnotation]
+}
+
 func flagAttestationID(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&attestationID, "attestation-id", "", "Unique identifier of the in-progress attestation")
 }
 
@@ -16,12 +16,19 @@
 package cmd
 
 import (
+	"bytes"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	controlplanev1 "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter"
 	v1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/rs/zerolog"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -106,6 +113,222 @@ func TestAttestationInitValidatesFlagsRegardlessOfRepositoryConfig(t *testing.T)
 	}
 }
 
+func TestAttestationRepositoryOrganizationCommands(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, ".chainloop.yml")
+	require.NoError(t, os.WriteFile(configPath, []byte("organization: repository-org\n"), 0o600))
+	configPath, err := filepath.EvalSymlinks(configPath)
+	require.NoError(t, err)
+	t.Chdir(dir)
+
+	for _, name := range []string{"init", "add", "push", "status", "reset"} {
+		t.Run(name, func(t *testing.T) {
+			_, cmd := newAttestationOrganizationTestCommand(t, name, "saved-org")
+			require.NoError(t, resolveAttestationOrganization(cmd))
+
+			organization, path := attestationOrganization(cmd)
+			assert.Equal(t, "repository-org", organization)
+			assert.Equal(t, configPath, path)
+			assert.Equal(t, "repository-org", effectiveOrganization(cmd))
+			assert.Equal(t, "saved-org", viper.GetString(confOptions.organization.viperKey))
+		})
+	}
+}
+
+func TestAttestationOrganizationPrecedence(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		flag        string
+		environment string
+		repository  string
+		local       string
+		want        string
+	}{
+		{name: "flag", flag: "flag-org", environment: "environment-org", repository: "repository-org", local: "local-org", want: "flag-org"},
+		{name: "environment", environment: "environment-org", repository: "repository-org", local: "local-org", want: "environment-org"},
+		{name: "repository", repository: "repository-org", local: "local-org", want: "repository-org"},
+		{name: "local state", local: "local-org", want: "local-org"},
+		{name: "saved default", want: "saved-org"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			if tc.repository != "" {
+				require.NoError(t, os.WriteFile(filepath.Join(dir, ".chainloop.yml"), []byte("organization: "+tc.repository+"\n"), 0o600))
+			}
+			t.Chdir(dir)
+
+			root, cmd := newAttestationOrganizationTestCommand(t, "status", "saved-org")
+			t.Setenv(CalculateEnvVarName(confOptions.organization.viperKey), tc.environment)
+			if tc.flag != "" {
+				require.NoError(t, root.PersistentFlags().Set(confOptions.organization.flagName, tc.flag))
+			}
+			if tc.local != "" {
+				attestationLocalStatePath = writeAttestationOrganizationState(t, tc.local)
+			}
+
+			require.NoError(t, resolveAttestationOrganization(cmd))
+			assert.Equal(t, tc.want, effectiveOrganization(cmd))
+		})
+	}
+}
+
+func TestAttestationVerifyDoesNotReadRepositoryOrganization(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".chainloop.yml"), []byte("organization: repository-org\n"), 0o600))
+	t.Chdir(dir)
+
+	_, cmd := newAttestationOrganizationTestCommand(t, "verify", "saved-org")
+	require.NoError(t, resolveAttestationOrganization(cmd))
+
+	organization, path := attestationOrganization(cmd)
+	assert.Empty(t, organization)
+	assert.Empty(t, path)
+	assert.Equal(t, "saved-org", effectiveOrganization(cmd))
+}
+
+func TestAttestationRepositoryOrganizationTokenMismatchStopsBeforeRootPreRun(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, ".chainloop.yml")
+	require.NoError(t, os.WriteFile(configPath, []byte("organization: repository-org\n"), 0o600))
+	configPath, err := filepath.EvalSymlinks(configPath)
+	require.NoError(t, err)
+	t.Chdir(dir)
+
+	root, cmd := newAttestationOrganizationTestCommand(t, "status", "saved-org")
+	rootPreRunCalled := false
+	root.PersistentPreRunE = func(*cobra.Command, []string) error {
+		rootPreRunCalled = true
+		return nil
+	}
+
+	claims := jwt.MapClaims{"aud": "api-token-auth.chainloop", "jti": "token-id", "org_name": "token-org"}
+	rawToken, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte("secret"))
+	require.NoError(t, err)
+	apiToken = rawToken
+
+	err = cmd.Parent().PersistentPreRunE(cmd, nil)
+	require.Error(t, err)
+	assert.False(t, rootPreRunCalled)
+	assert.ErrorContains(t, err, "token-org")
+	assert.ErrorContains(t, err, "repository-org")
+	assert.ErrorContains(t, err, "use an API token for")
+	assert.ErrorContains(t, err, "remove organization")
+	assert.ErrorContains(t, err, configPath)
+}
+
+func TestAttestationRepositoryOrganizationLegacyTokenStopsBeforeRootPreRun(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, ".chainloop.yml")
+	require.NoError(t, os.WriteFile(configPath, []byte("organization: repository-org\n"), 0o600))
+	configPath, err := filepath.EvalSymlinks(configPath)
+	require.NoError(t, err)
+	t.Chdir(dir)
+
+	root, cmd := newAttestationOrganizationTestCommand(t, "status", "saved-org")
+	rootPreRunCalled := false
+	root.PersistentPreRunE = func(*cobra.Command, []string) error {
+		rootPreRunCalled = true
+		return nil
+	}
+
+	claims := jwt.MapClaims{"aud": "api-token-auth.chainloop", "jti": "legacy-token-id"}
+	rawToken, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte("secret"))
+	require.NoError(t, err)
+	apiToken = rawToken
+
+	err = cmd.Parent().PersistentPreRunE(cmd, nil)
+	require.Error(t, err)
+	assert.False(t, rootPreRunCalled)
+	assert.ErrorContains(t, err, "does not identify its organization")
+	assert.ErrorContains(t, err, "create a new API token for \"repository-org\"")
+	assert.ErrorContains(t, err, "remove organization")
+	assert.ErrorContains(t, err, configPath)
+}
+
+func TestAttestationRepositoryOrganizationMembershipErrorPreservesSavedDefault(t *testing.T) {
+	_, cmd := newAttestationOrganizationTestCommand(t, "status", "saved-org")
+	path := filepath.Join(t.TempDir(), ".chainloop.yml")
+	setAttestationOrganization(cmd, "repository-org", path)
+
+	err := handleOrganizationExecutionError(cmd, controlplanev1.ErrorUserNotMemberOfOrgErrorNotInOrg("not a member"))
+	require.Error(t, err)
+	assert.ErrorContains(t, err, path)
+	assert.Equal(t, "saved-org", viper.GetString(confOptions.organization.viperKey))
+}
+
+func TestAttestationRepositoryOrganizationNotice(t *testing.T) {
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, ".chainloop.yml")
+	require.NoError(t, os.WriteFile(configPath, []byte("organization: repository-org\n"), 0o600))
+	configPath, err := filepath.EvalSymlinks(configPath)
+	require.NoError(t, err)
+	t.Chdir(dir)
+
+	_, cmd := newAttestationOrganizationTestCommand(t, "status", "saved-org")
+	var output bytes.Buffer
+	previousLogger := logger
+	logger = zerolog.New(&output)
+	t.Cleanup(func() { logger = previousLogger })
+	require.NoError(t, resolveAttestationOrganization(cmd))
+
+	assert.Equal(t, 1, strings.Count(output.String(), "using organization from repository config"))
+	assert.Contains(t, output.String(), "repository-org")
+	assert.Contains(t, output.String(), configPath)
+	assert.Equal(t, "saved-org", viper.GetString(confOptions.organization.viperKey))
+}
+
+func newAttestationOrganizationTestCommand(t *testing.T, command, savedOrganization string) (*cobra.Command, *cobra.Command) {
+	t.Helper()
+
+	viper.Reset()
+	t.Cleanup(viper.Reset)
+	t.Setenv(tokenEnvVarName, "")
+	t.Setenv(CalculateEnvVarName(confOptions.organization.viperKey), "")
+
+	previousAPIToken := apiToken
+	previousLocalStatePath := attestationLocalStatePath
+	previousRemoteState := useAttestationRemoteState
+	previousLogger := logger
+	apiToken = ""
+	attestationLocalStatePath = filepath.Join(t.TempDir(), "missing-state.json")
+	useAttestationRemoteState = false
+	logger = zerolog.Nop()
+	t.Cleanup(func() {
+		apiToken = previousAPIToken
+		attestationLocalStatePath = previousLocalStatePath
+		useAttestationRemoteState = previousRemoteState
+		logger = previousLogger
+	})
+
+	viper.SetConfigType("toml")
+	require.NoError(t, viper.ReadConfig(strings.NewReader("organization = \""+savedOrganization+"\"\n")))
+
+	root := &cobra.Command{Use: appName, PersistentPreRunE: func(*cobra.Command, []string) error { return nil }}
+	root.PersistentFlags().String(confOptions.organization.flagName, "", "")
+	require.NoError(t, viper.BindPFlag(confOptions.organization.viperKey, root.PersistentFlags().Lookup(confOptions.organization.flagName)))
+	require.NoError(t, viper.BindEnv(confOptions.organization.viperKey, CalculateEnvVarName(confOptions.organization.viperKey)))
+
+	attestationCmd := newAttestationCmd()
+	root.AddCommand(attestationCmd)
+	for _, candidate := range attestationCmd.Commands() {
+		if candidate.Name() == command {
+			return root, candidate
+		}
+	}
+	require.FailNowf(t, "attestation command not found", "command: %q", command)
+	return nil, nil
+}
+
+func writeAttestationOrganizationState(t *testing.T, organization string) string {
+	t.Helper()
+	state := &crafter.VersionedCraftingState{CraftingState: &v1.CraftingState{Attestation: &v1.Attestation{Workflow: &v1.WorkflowMetadata{Organization: organization}}}}
+	raw, err := protojson.Marshal(state)
+	require.NoError(t, err)
+	path := filepath.Join(t.TempDir(), "state.json")
+	require.NoError(t, os.WriteFile(path, raw, 0o600))
+	return path
+}
+
 func TestExtractAnnotations(t *testing.T) {
 	testCases := []struct {
 		input   []string