diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 21b678a..7018c73 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -2,6 +2,10 @@ name: Release APK
 
 on: [push, pull_request]
 
+permissions:
+  id-token: write
+  attestations: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -48,8 +52,14 @@ jobs:
       env:
         BUILD_TOOLS_VERSION: "34.0.0"
 
+    - name: Attest APK
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: 'app/build/outputs/apk/release/*.apk'
+
     - name: Upload release files
       uses: softprops/action-gh-release@v2
       if: startsWith(github.ref, 'refs/tags/')
       with:
         files: ${{steps.sign_app.outputs.signedReleaseFile}}
+