diff --git a/.editorconfig b/.editorconfig
index 81f3ec3..991824c 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -8,3 +8,8 @@ insert_final_newline = true
 indent_style = tab
 indent_size = 4
 tab_width = 4
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+tab_width = 2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fbb21c4..e9c64b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,18 +10,32 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
-      - name: Use Node.js
-        uses: actions/setup-node@v3
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          node-version: "18.x"
+          node-version: 24
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm install
 
       - name: Build plugin
-        run: |
-          npm install
-          npm run build
+        run: npm run build
+
+      - name: Attest build provenance
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
 
       - name: Create release
         env:
diff --git a/package.json b/package.json
index 0c87ae3..cc8ab5b 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,8 @@
 		"dev": "node esbuild.config.mjs",
 		"build": "tsc -noEmit -skipLibCheck && node esbuild.config.mjs production",
 		"version": "node version-bump.mjs && git add manifest.json versions.json",
-		"lint": "eslint ."
+		"lint": "eslint .",
+		"release": "git push origin HEAD --follow-tags"
 	},
 	"keywords": [],
 	"license": "MIT",