diff --git a/.github/workflows/publish_nuget.yml b/.github/workflows/publish_nuget.yml
index 75fd9a40..1bf0926b 100644
--- a/.github/workflows/publish_nuget.yml
+++ b/.github/workflows/publish_nuget.yml
@@ -25,8 +25,10 @@ jobs:
     permissions:
       contents: read
       # NuGet/login exchanges this workflow's OIDC token for a short-lived
-      # nuget.org api key, so no push secret is stored in the repo.
+      # nuget.org api key, so no push secret is stored in the repo. The same token
+      # signs the build provenance below.
       id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -61,6 +63,14 @@ jobs:
           dotnet pack csharp/PhoneNumbers.Extensions -c Release --no-restore \
             -p:VersionPrefix="${VERSION}" -o artifacts
 
+      # Signed, verifiable provenance for what is about to be pushed: which workflow, at which
+      # commit, produced these exact bytes. Runs before the push so nothing is published without
+      # it. Verify with: gh attestation verify <file> --repo twcclegg/libphonenumber-csharp
+      - name: Attest package provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: 'artifacts/*.nupkg'
+
       - name: Upload packages
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with: