diff --git a/script/publish.js b/script/publish.js
index 4cd8776..82e4a80 100644
--- a/script/publish.js
+++ b/script/publish.js
@@ -3,7 +3,7 @@ const { getOtp } = require('@continuous-auth/client')
 const { spawnSync } = require('child_process')
 
 async function publish () {
-  const { status } = spawnSync('npm', ['publish', '--otp', await getOtp()])
+  const { status } = spawnSync('npm', ['publish', '--provenance', '--otp', await getOtp()])
   process.exit(status)
 }