diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index e63d8185..5e70163e 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -62,7 +62,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.TOKEN }}
 
       - name: publish
-        run: npm publish *.tgz
+        run: npm publish --provenance *.tgz
 
       - name: notify slack on failure
         if: failure()