diff --git a/.github/workflows/push-build.yaml b/.github/workflows/push-build.yaml
index 8aec1832e..a5ec7efc0 100644
--- a/.github/workflows/push-build.yaml
+++ b/.github/workflows/push-build.yaml
@@ -15,6 +15,7 @@ defaults:
 permissions:
   contents: read
   packages: write
+  id-token: write  # for cosign OIDC keyless signing
 
 jobs:
   push-image-to-container-registry:
@@ -36,6 +37,9 @@ jobs:
         with:
           platforms: all
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@4ea7c83ed23e5b1b86ff0db87c63b87e4d72c410 # v3.8.0
+
       - name: log in to container registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
diff --git a/build/release/Makefile b/build/release/Makefile
index df8002b5f..eb7e6b718 100644
--- a/build/release/Makefile
+++ b/build/release/Makefile
@@ -156,6 +156,7 @@ define chart.targets
 promote.chart.$(1).$(2):
 	@echo === helm push $(2) to $(1)
 	$(HELM) push $(HELM_OUTPUT_DIR)/$(2)-$(HELM_CHART_VERSION).tgz oci://$(1)
+	cosign sign --yes $(1)/$(2):$(HELM_CHART_VERSION)
 promote.all.charts: promote.chart.$(1).$(2)
 endef
 $(foreach r,$(REGISTRIES), $(foreach c,$(HELM_CHARTS),$(eval $(call chart.targets,$(r),$(c)))))
@@ -184,6 +185,8 @@ build.all.images: build.image.$(1).$(2)
 publish.image.$(1).$(2):
 	@$(DOCKERCMD) push $(1)/ceph-$(2):$(VERSION)
 	@$(DOCKERCMD) push $(1)/ceph-$(2):$(BRANCH_NAME)
+	cosign sign --yes $(1)/ceph-$(2):$(VERSION)
+	cosign sign --yes $(1)/ceph-$(2):$(BRANCH_NAME)
 
 publish.all.images.$(1): publish.image.$(1).$(2)
 endef
@@ -193,12 +196,13 @@ define repo.manifest.targets
 publish.manifest.image.$(1): publish.all.images.$(1) $(MANIFEST_TOOL)
 	$(MANIFEST_TOOL) push from-args --platforms $(IMAGE_PLATFORMS_COMMA) --template $(1)/ceph-ARCH:$(VERSION) --target $(1)/ceph:$(VERSION)
 	$(MANIFEST_TOOL) push from-args --platforms $(IMAGE_PLATFORMS_COMMA) --template $(1)/ceph-ARCH:$(BRANCH_NAME) --target $(1)/ceph:$(BRANCH_NAME)
+	cosign sign --yes $(1)/ceph:$(VERSION)
+	cosign sign --yes $(1)/ceph:$(BRANCH_NAME)
 
 publish.images: publish.manifest.image.$(1)
 endef
 $(foreach r,$(REGISTRIES),$(eval $(call repo.manifest.targets,$(r))))
 
-
 build.images: build.all.images
 build.charts: build.all.charts
 promote.charts: promote.all.charts