diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 4dc85a5..a9435a8 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -137,6 +137,11 @@ jobs:
           tags: |
             repo.meghsakha.com/breakpilot/portal:latest
             repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
+      - name: sign image (cosign)
+        run: |
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal:latest || echo "::warning::cosign failed"
       - name: trigger orca redeploy
         # Signs the POST with HMAC-SHA256 over the JSON body using the
         # secret orca generated when the webhook was registered. Orca's