diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4975f0b50..f8d3cf3ab 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -103,6 +103,11 @@ jobs:
           cue fmt --simplify $(git diff --name-only)
       - name: Run diff
         run: git --no-pager diff
+      - name: Sign commit hash
+        run: |
+          echo "${{ secrets.DEPLOY_PRIV_KEY }}" > /tmp/privkey
+          updater signing sign -k /tmp/privkey "${{ github.sha }}"
+          rm /tmp/privkey
       # - name: Commit and push
         #   uses: EndBug/add-and-commit@v9
         #   with: