diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2833056..c0edc0c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -155,8 +155,8 @@ jobs:
           # WAN transfer (see JEF-87 / measure in JEF-82).
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          provenance: false
-          sbom: false
+          provenance: true
+          sbom: true
       - uses: sigstore/cosign-installer@v3
       - name: Sign the image (keyless)
         # Sign by immutable digest, not tag. Keyless: GitHub's OIDC token is