diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b3eaa78e..fddd567d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -27,6 +27,15 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.2
+
+      - name: Generate and sign SBOM
+        run: make sbom
+        env:
+          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with: