diff --git a/.ci/buildAndPush.sh b/.ci/buildAndPush.sh
index 7194e1bf..526ba66d 100755
--- a/.ci/buildAndPush.sh
+++ b/.ci/buildAndPush.sh
@@ -32,7 +32,7 @@ else # other error
     echo $OUTPUT
 fi
 
-docker buildx build --push \
+docker buildx build --push --provenance=true \
     --platform linux/amd64,linux/arm64 \
     $TAGS \
     --build-arg COMMIT_HASH=$COMMIT_HASH \
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6cffbe7d..9ae99ac3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 3.6.1
+
+-   provenance attestations on the Docker Images
+
 ## 3.6.0
 
 -   new module: 'PubSubPublisher' (see https://enmeshed.eu/operate/configuration#pubsubpublisher for more details on how to configure it)
diff --git a/package-lock.json b/package-lock.json
index 477b6709..5f76f558 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "@nmshd/connector",
-    "version": "3.6.0",
+    "version": "3.6.1",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "@nmshd/connector",
-            "version": "3.6.0",
+            "version": "3.6.1",
             "license": "MIT",
             "workspaces": [
                 ".",
diff --git a/package.json b/package.json
index 260e475b..bd10de61 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@nmshd/connector",
-    "version": "3.6.0",
+    "version": "3.6.1",
     "private": true,
     "description": "The Enmeshed Connector",
     "homepage": "https://enmeshed.eu/integrate",