diff --git a/.changeset/ci-provenance.md b/.changeset/ci-provenance.md
new file mode 100644
index 00000000..c9e289db
--- /dev/null
+++ b/.changeset/ci-provenance.md
@@ -0,0 +1,4 @@
+---
+"@cloudhal/cli": patch
+---
+Cloudhal packages are now published from GitHub Actions with npm trusted publishing and provenance: each version on npm links to the commit and workflow run that built it, and `npm audit signatures` verifies it.