diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml
index b0c69de4d6..569b24184f 100644
--- a/.github/workflows/ci-pipeline.yml
+++ b/.github/workflows/ci-pipeline.yml
@@ -2013,6 +2013,9 @@ jobs:
     if: (!(cancelled() || failure())) && github.event.ref == 'refs/heads/master' && contains(github.event.head_commit.message, '[TGSDeploy]') && needs.deployment-gate.result == 'success'
     env:
       TGS_TELEMETRY_KEY_FILE: C:/tgs_telemetry_key.txt
+    permissions:
+      id-token: write
+      attestations: write
     steps:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
@@ -2148,6 +2151,52 @@ jobs:
           name: release_notes_bins
           path: release_notes_bins
 
+      - name: Upload Server Console Zip Artifact to Action
+        uses: actions/upload-artifact@v4
+        with:
+          name: server-console-release
+          path: ./ServerConsole.zip
+
+      - name: Generate Server Console Artifact Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./ServerConsole.zip
+
+      - name: Generate Server Service Artifact Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./ServerService.zip
+
+      - name: Generate DMAPI Artifact Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./DMAPI.zip
+
+      - name: Generate REST API Artifact Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./swagger/tgs_api.json
+
+      - name: Generate GraphQL API Artifact Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./schema/tgs-api.graphql
+
+      - name: Generate Debian Packaging Artifact Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
+
+      - name: Generate MariaDB .msi Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/mariadb.msi
+
+      - name: Generate Installer .exe Attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ./build/package/winget/tgstation-server-installer.exe
+
       - name: Generate App Token
         id: app-token-generation
         uses: actions/create-github-app-token@v1
@@ -2171,18 +2220,6 @@ jobs:
           body_path: release_notes.md
           commitish: ${{ github.event.head_commit.id }}
 
-      - name: Generate Server Console Artifact Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./ServerConsole.zip
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
-      - name: Upload Server Console Zip Artifact to Action
-        uses: actions/upload-artifact@v4
-        with:
-          name: server-console-release
-          path: ./ServerConsole.zip
-
       - name: Upload Server Console Artifact to Release
         uses: actions/upload-release-asset@v1
         env:
@@ -2193,12 +2230,6 @@ jobs:
           asset_name: ServerConsole.zip
           asset_content_type: application/zip
 
-      - name: Generate Server Service Artifact Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./ServerService.zip
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload Server Service Artifact
         uses: actions/upload-release-asset@v1
         env:
@@ -2209,12 +2240,6 @@ jobs:
           asset_name: ServerService.zip
           asset_content_type: application/zip
 
-      - name: Generate DMAPI Artifact Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./DMAPI.zip
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload DMAPI Artifact
         uses: actions/upload-release-asset@v1
         env:
@@ -2225,12 +2250,6 @@ jobs:
           asset_name: DMAPI.zip
           asset_content_type: application/zip
 
-      - name: Generate REST API Artifact Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./swagger/tgs_api.json
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload REST API Artifact
         uses: actions/upload-release-asset@v1
         env:
@@ -2241,12 +2260,6 @@ jobs:
           asset_name: swagger.json
           asset_content_type: application/json
 
-      - name: Generate GraphQL API Artifact Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./schema/tgs-api.graphql
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload GraphQL API Artifact
         uses: actions/upload-release-asset@v1
         env:
@@ -2273,12 +2286,6 @@ jobs:
           asset_name: ServerUpdatePackage.zip
           asset_content_type: application/zip
 
-      - name: Generate Debian Packaging Artifact Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload Debian Packaging Artifact
         uses: actions/upload-release-asset@v1
         env:
@@ -2289,12 +2296,6 @@ jobs:
           asset_name: tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
           asset_content_type: application/x-tar
 
-      - name: Generate MariaDB .msi Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/mariadb.msi
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload MariaDB .msi
         uses: actions/upload-release-asset@v1
         env:
@@ -2305,12 +2306,6 @@ jobs:
           asset_name: mariadb-${{ env.MARIADB_VERSION }}-winx64.msi
           asset_content_type: application/octet-stream
 
-      - name: Generate Installer .exe Attestation
-        uses: actions/attest-build-provenance@v1
-        with:
-          subject-path: ./build/package/winget/tgstation-server-installer.exe
-          github-token: ${{ steps.app-token-generation.outputs.token }}
-
       - name: Upload Installer .exe
         uses: actions/upload-release-asset@v1
         env: