diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml
index 308b3e81..a8343ff3 100644
--- a/.github/actions/publish/action.yml
+++ b/.github/actions/publish/action.yml
@@ -11,6 +11,10 @@ inputs:
   tag:
     description: 'Tag to upload artifacts to.'
     required: true
+outputs:
+  hashes: 
+    description: sha256sum hashes of built artifacts
+    value: ${{ steps.hash.outputs.hashes }}
 
 runs:
   using: composite
@@ -27,7 +31,11 @@ runs:
       uses: goreleaser/goreleaser-action@v5
       with:
         version: latest
-        args: release --clean ${{ inputs.dry-run == 'true' && '--skip=publish' || '' }}
+        args: release ${{ inputs.dry-run == 'true' && '--skip=publish' || '' }}
       env:
         GITHUB_TOKEN: ${{ inputs.token }}
-        
\ No newline at end of file
+    - name: Hash build artifacts for provenance 
+      id: hash
+      shell: bash
+      run: | 
+        echo "hashes=$(sha256sum dist/* | base64 -w0)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 3424f871..ffefed2e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -6,7 +6,6 @@ on:
       - main
 
 jobs:
-
   release-please:
     runs-on: ubuntu-latest
     outputs:
@@ -23,18 +22,32 @@ jobs:
     permissions:
       id-token: write # Needed to obtain Docker tokens
       contents: write # Needed to upload release artifacts
-
     needs: [ release-please ]
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
+    outputs: 
+      hashes: ${{ steps.publish.outputs.hashes }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: ./.github/actions/publish
+      - id: publish
+        uses: ./.github/actions/publish
         with:
           dry-run: 'false'
           token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ needs.release-please.outputs.tag_name }}
+
+  release-ldcli-provenance:
+    needs: ['release-please', 'release-ldcli']
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
+    with:
+      base64-subjects: "${{ needs.release-ldcli.outputs.hashes }}"
+      upload-assets: true
+      upload-tag-name: ${{ needs.release-please.outputs.tag_name }}