diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
index 1c21eba..5502cce 100644
--- a/.github/workflows/docker.yaml
+++ b/.github/workflows/docker.yaml
@@ -116,16 +116,24 @@ jobs:
           format: 'cyclonedx-json'
           output-file: 'sbom.cyclonedx.json'
           upload-release-assets: false
+      # actions/attest picks the attestation type from its inputs: sbom-path
+      # yields an SBOM attestation, its absence a SLSA build provenance one.
+      # create-storage-record only feeds the org Linked Artifacts page, which
+      # we dont use. It defaults to true whenever push-to-registry is set and
+      # has only ever failed here with "no artifacts found", so turn it off
+      # rather than keep two bogus warnings per image in every build.
       - name: Attest SBOM
-        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
           subject-digest: ${{ steps.image.outputs.digest }}
           sbom-path: 'sbom.cyclonedx.json'
           push-to-registry: true
+          create-storage-record: false
       - name: Attest provenance
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
           subject-digest: ${{ steps.image.outputs.digest }}
           push-to-registry: true
+          create-storage-record: false