diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 62c2f9c..bf2ce95 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -77,6 +77,11 @@ jobs:
       watch-jobs: release
       collect-artifacts: false
       release: ${{ needs.release.outputs.tag_name }}
+      # Run a released, provenance-verified attester rather than building
+      # the tip of this repository, which is unpinned and unverified. The
+      # attester attesting a release is therefore always the previous one.
+      build-from-source: false
+      version: v0.1.0-rc.3
 
   # Publish the provenance to the release. The installer action verifies the
   # downloaded binaries against this file, so it must land on the release as