diff --git a/.chainguard/source.yaml b/.chainguard/source.yaml
new file mode 100644
index 0000000..97f63e9
--- /dev/null
+++ b/.chainguard/source.yaml
@@ -0,0 +1,9 @@
+# Copyright 2023 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+spec:
+  authorities:
+    - keyless: {}
+    - key:
+        # Allow commits signed by GitHub.
+        kms: https://github.com/web-flow.gpg