diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml
new file mode 100644
index 000000000..405b13b3f
--- /dev/null
+++ b/.github/actions/sign-image/action.yml
@@ -0,0 +1,39 @@
+name: Sign container images
+description: >
+  Keyless cosign signature on each image, then a verification pass against the
+  identity the signature should carry, so a misconfigured job fails here and not
+  on someone's cluster. That identity is the calling workflow's own,
+  https://github.com/<owner>/<repo>/.github/workflows/<file>@<ref>.
+  The calling job needs `id-token: write` and a registry login for every image.
+
+inputs:
+  images:
+    description: Image references by digest (name@sha256:...), whitespace separated.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install cosign
+      uses: sigstore/cosign-installer@v4.1.2
+
+    - name: Sign
+      shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+      run: |
+        set -euo pipefail
+        # The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
+        # is not read by the Kyverno and policy-controller releases in use today.
+        cosign sign --yes --recursive --new-bundle-format=false $IMAGES
+
+    - name: Verify
+      shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+      run: |
+        set -euo pipefail
+        cosign verify \
+          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+          --certificate-identity "https://github.com/$GITHUB_WORKFLOW_REF" \
+          $IMAGES
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2e7a327bd..57d44a6ac 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,7 +1,9 @@
 version: 2
 updates:
 - package-ecosystem: "github-actions"
-  directory: "/"
+  directories:
+    - "/"
+    - "/.github/actions/sign-image"
   schedule:
       interval: "weekly"
 - package-ecosystem: gomod