diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 45afc64..b235165 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,10 @@ jobs:
     name: Build (${{ matrix.target }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
     strategy:
       fail-fast: false
       matrix:
@@ -56,6 +60,10 @@ jobs:
         shell: pwsh
         run: |
           Compress-Archive -Path target/${{ matrix.target }}/release/typdiff.exe -DestinationPath typdiff-${{ matrix.target }}.zip
+      - name: Attest build provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: typdiff-${{ matrix.target }}.*
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: typdiff-${{ matrix.target }}
diff --git a/README.md b/README.md
index 2ae40bf..475f1f8 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,14 @@ Compile the output with `typst compile` to get a PDF with visual diff markup.
 
 ## Installation
 
+### With mise (recommended)
+
+[mise](https://mise.jdx.dev/) installs the appropriate prebuilt binary for your platform and verifies GitHub Artifact Attestations when available.
+
+```sh
+mise use -g github:sou1118/typdiff
+```
+
 ### From crates.io
 
 ```sh