diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 8da3005..4fd5997 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -16,8 +16,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: "pages"
@@ -45,6 +43,10 @@ jobs:
           path: ./_site
 
   deploy:
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/action.yml b/action.yml
index e0e9e78..a44bd16 100644
--- a/action.yml
+++ b/action.yml
@@ -118,6 +118,9 @@ runs:
             --pattern "$archive" --pattern checksums.txt
           (cd "$dl" && if command -v sha256sum > /dev/null; then sha256sum --check --ignore-missing checksums.txt; \
             else shasum -a 256 --check --ignore-missing checksums.txt; fi)
+          # Checksums and archive can be replaced together. Provenance binds
+          # this exact archive to the repository's trusted release workflow.
+          gh attestation verify "$dl/$archive" --repo TMHSDigital/subenum
           if [ "$ext" = zip ]; then unzip -o -q "$dl/$archive" -d "$dl/x"; else mkdir -p "$dl/x" && tar -xzf "$dl/$archive" -C "$dl/x"; fi
           find "$dl/x" -maxdepth 2 -name 'subenum*' -type f \( -name subenum -o -name subenum.exe \) -exec cp {} "$bin/" \;
         fi