diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9bfcc36..a95350f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,10 +19,10 @@ jobs:
   artifacts:
     name: artifacts
     permissions:
-      contents: write # Needed to upload artifacts.
-      id-token: write # Needed for attestation.
-      attestations: write # Needed for attestations.
+      contents: read # Needed to checkout the repository.
     runs-on: ubuntu-latest
+    outputs:
+      artifact-digest: "${{ steps.upload.outputs.artifact-digest }}"
     steps:
     - name: harden runner
       uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -48,9 +48,24 @@ jobs:
         name: artifacts
         path: target/assemble/*
 
+  # Attestation runs in its own job so that pull requests, which run the build with
+  # code from the pull request, never get the permissions needed to attest.
+  attest:
+    name: attest
+    needs: artifacts
+    if: github.event_name != 'pull_request'
+    permissions:
+      id-token: write # Needed for attestation.
+      attestations: write # Needed for attestations.
+    runs-on: ubuntu-latest
+    steps:
+    - name: harden runner
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+      with:
+        egress-policy: audit
+
     - name: 'attest artifacts'
       uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
         subject-name: artifacts.zip
-        subject-digest: "sha256:${{ steps.upload.outputs.artifact-digest }}"
-      if: github.event_name != 'pull_request'
+        subject-digest: "sha256:${{ needs.artifacts.outputs.artifact-digest }}"