diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1ed37f9f..bf1bde10 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -57,12 +57,22 @@ jobs:
           find bin -type f ! -name checksums.txt | sort | xargs sha256sum > bin/checksums.txt
 
       - name: Attest build provenance
+        id: attest
         # actions/attest defaults to SLSA build provenance when no sbom-path or
         # predicate input is given.
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: 'bin/arc-*-*' # binaries only; runs before signing so the .sigstore.json bundles are not yet present
 
+      - name: Keep the provenance as a release asset
+        # The step above only writes to GitHub's attestation store. OpenSSF
+        # Scorecard's Signed-Releases check detects provenance by filename and
+        # never looks there, so ship the same bundle as *.intoto.jsonl. Verify
+        # with: gh attestation verify <binary> --bundle arc-<tag>.intoto.jsonl
+        env:
+          BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+        run: cp "${BUNDLE}" "bin/arc-${GITHUB_REF_NAME}.intoto.jsonl"
+
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
@@ -73,7 +83,7 @@ jobs:
           cd bin
           for f in *; do
             [ -f "$f" ] || continue
-            case "$f" in *.sigstore.json) continue ;; esac
+            case "$f" in *.sigstore.json | *.intoto.jsonl) continue ;; esac
             # Emit a Sigstore bundle (signature + cert + Rekor proof), named
             # *.sigstore.json so OpenSSF Scorecard's Signed-Releases check
             # detects it. Don't revert to --output-signature/--output-certificate: