diff --git a/.github/workflows/shared-go-auto-release.yml b/.github/workflows/shared-go-auto-release.yml
index f36dd78f..78bc991e 100644
--- a/.github/workflows/shared-go-auto-release.yml
+++ b/.github/workflows/shared-go-auto-release.yml
@@ -104,6 +104,15 @@ jobs:
         run: |-
           sudo apt-get update && sudo apt-get install -y git gnupg2
 
+      - name: Harden Runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      # syft binary that .goreleaser.yml's sboms: block shells out to.
+      - name: "Install syft"
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -236,6 +245,7 @@ jobs:
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        id: releaser
         with:
           workdir: source
           version: latest
@@ -246,6 +256,60 @@ jobs:
           GO_RELEASER_TARGET_COMMITISH: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
           GO_RELEASER_DRAFT_MODE: ${{ inputs.draft }}
 
+      # Real Sigstore-backed provenance for every binary this job just built
+      # locally — no longer a re-fetch, so this is genuine build-time
+      # GitHub-native attestation stacked on top of cosign (a different
+      # verification mechanism/consumer than cosign, e.g. `gh attestation
+      # verify`), not a second re-fetch-and-sign layer.
+      - name: "Attest build provenance"
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          github-token: ${{ steps.github-app.outputs.token }}
+          subject-path: 'source/dist/*'
+
+      - name: "Resolve checksums file"
+        id: checksums
+        run: |
+          file="$(find source/dist -maxdepth 1 -name '*_SHA256SUMS' -print -quit)"
+          if [ -z "$file" ]; then
+            echo "No *_SHA256SUMS file found in dist/" >&2
+            exit 1
+          fi
+          echo "file=$file" >> "$GITHUB_OUTPUT"
+
+      # Bind a source-tree SBOM to the checksums file — it already commits to
+      # every binary's exact digest, so it's a well-defined single-artifact
+      # anchor for a release that ships multiple platform binaries. Separate
+      # from .goreleaser.yml's per-archive sboms: block (bound to individual
+      # archives, uploaded to the release directly by GoReleaser itself).
+      # - name: "Generate and attest source-tree SBOM"
+      #   uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+      #   with:
+      #     github-token: ${{ steps.github-app.outputs.token }}
+      #     path: source/
+      #     format: spdx-json
+      #     output-file: source/dist/atmos-sbom.spdx.json
+      #     # We upload the SBOM to the GitHub release ourselves in the next
+      #     # step, so skip the action's own GH Actions workflow-artifact
+      #     # upload — it depends on the runner's internal artifact-caching
+      #     # proxy, which has been unreliable on our self-hosted runners.
+      #     upload-artifact: false
+
+      # - name: "Attest SBOM"
+      #   uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+      #   with:
+      #     github-token: ${{ steps.github-app.outputs.token }}
+      #     subject-path: source/
+      #     sbom-path: source/dist/atmos-sbom.spdx.json
+
+      # - name: "Upload source-tree SBOM to the release"
+      #   env:
+      #     GITHUB_TOKEN: ${{ steps.github-app.outputs.token }}
+      #     TAG: ${{ fromJSON(steps.releaser.outputs.metadata).tag }}
+      #   run: |
+      #     gh release upload "$TAG" source/dist/atmos-sbom.spdx.json \
+      #       --repo "${{ github.repository }}" --clobber
+
       - name: Check disk space after
         if: success() || failure()
         shell: bash