diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index a675f9f25d..3591539b68 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -29,7 +29,6 @@ jobs:
     defaults:
       run:
         working-directory: ./cli
-
     steps:
       - id: token
         uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
@@ -59,7 +58,7 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
-      - run: pnpm publish --no-git-checks
+      - run: pnpm publish --provenance --no-git-checks
         if: ${{ github.event_name == 'release' }}
 
   docker:
diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index 99e6ba2e11..bd2c292ad5 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -44,4 +44,4 @@ jobs:
       - name: Build
         run: pnpm build
       - name: Publish
-        run: pnpm publish --no-git-checks
+        run: pnpm publish --provenance --no-git-checks