diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..c36a4c1
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,21 @@
+name: release
+
+# Release provenance via the bounded-systems mint capability. On a v<version> tag
+# (cut by `mint release`), emits the deterministic in-toto release Statement
+# (tag → version plan → commit), keyless-signs it (cosign/OIDC), and attaches it
+# to the GitHub release. The registry publish stays in its existing workflow;
+# this job owns VERSION + TAG provenance only. Pinned to an immutable mint commit
+# SHA; bump when mint tags.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write   # create / upload to the GitHub release
+  id-token: write   # OIDC — cosign keyless signing
+
+jobs:
+  release:
+    uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.3.1 # mint
+    with:
+      ref: v0.3.1
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 6d0a6ab..b5ac312 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -2,7 +2,7 @@ name: version
 
 # Versioning via the bounded-systems mint capability. Validates .release/ intents
 # (fails closed on a malformed one) and previews the next version on every PR.
-# Pinned to mint v0.2.0 (immutable commit SHA); bump when mint releases again.
+# Pinned to an immutable mint commit SHA; bump when mint tags.
 on:
   push:
     branches: [main]
@@ -13,6 +13,6 @@ permissions:
 
 jobs:
   version:
-    uses: bounded-systems/mint/.github/workflows/version.yml@440c191198bdb4c2eabb60b385e5c24cddb01e82 # v0.2.0
+    uses: bounded-systems/mint/.github/workflows/version.yml@v0.3.1 # mint
     with:
-      ref: 440c191198bdb4c2eabb60b385e5c24cddb01e82
+      ref: v0.3.1