diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 744962a..8cdb8e9 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -55,6 +55,9 @@ steps:
           push: true
           build-args:
             - NAME=${APP_NAME}
+      - equinixmetal-buildkite/cosign#main:
+          image: "${IMAGE_REPO}:${IMAGE_TAG}"
+          keyless: true
       - equinixmetal-buildkite/trivy#v1.18.3:
           severity: CRITICAL,HIGH
           ignore-unfixed: true