diff --git a/.changeset/puny-squids-play.md b/.changeset/puny-squids-play.md
new file mode 100644
index 0000000..5385612
--- /dev/null
+++ b/.changeset/puny-squids-play.md
@@ -0,0 +1,6 @@
+---
+'@lglab/react-qr-code': patch
+'reactqrcode.com': patch
+---
+
+ci:changset provenance
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a3cb65d..56e7b0e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,3 +45,4 @@ jobs:
           publish: pnpm ci:publish --no-git-checks
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true