diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55c8cb7..df52de4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,6 +31,10 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  # Provenance attestation for the published release assets (main.js, styles.css,
+  # manifest.json) - lets users cryptographically verify they were built here.
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -152,6 +156,15 @@ jobs:
         if: steps.ver.outputs.release == 'true'
         run: node scripts/check-bundle.mjs
 
+      - name: Attest build provenance
+        if: steps.ver.outputs.release == 'true'
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            main.js
+            styles.css
+            manifest.json
+
       - name: Create GitHub Release
         if: steps.ver.outputs.release == 'true'
         uses: softprops/action-gh-release@v3
@@ -165,7 +178,7 @@ jobs:
 
             ### Install (manual)
             Download `main.js`, `manifest.json`, and `styles.css` below into
-            `<your-vault>/.obsidian/plugins/agentage-memory/`, then enable
+            your vault's `.obsidian/plugins/agentage-memory/` folder, then enable
             **Agentage Sync** under Settings → Community plugins.
 
             ### Install (BRAT)
diff --git a/README.md b/README.md
index fffe2bc..9d7cd98 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ Install [BRAT](https://github.com/TfTHacker/obsidian42-brat), then **Add beta pl
 
 ### Manual
 
-From the [latest release](https://github.com/agentage/obsidian-sync/releases/latest), copy `main.js`, `manifest.json`, and `styles.css` into `<your-vault>/.obsidian/plugins/agentage-memory/`, then enable **Agentage Sync** under Settings → Community plugins.
+From the [latest release](https://github.com/agentage/obsidian-sync/releases/latest), copy `main.js`, `manifest.json`, and `styles.css` into your vault's `.obsidian/plugins/agentage-memory/` folder, then enable **Agentage Sync** under Settings → Community plugins.
 
 ## Getting started
 
diff --git a/manifest.json b/manifest.json
index 9e0bdbf..76edcfb 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
 	"id": "agentage-memory",
 	"name": "Agentage Sync",
-	"version": "0.2.1",
+	"version": "0.2.2",
 	"minAppVersion": "1.11.4",
 	"description": "Let Claude, ChatGPT, Cursor, and any MCP client read and write your Obsidian vault. Two-way Git sync to a private memory, safe merges with flagged conflicts, plain Markdown you own. Up to 100 MB included.",
 	"author": "agentage",
diff --git a/package-lock.json b/package-lock.json
index c23c7fe..1835491 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,17 +1,17 @@
 {
   "name": "obsidian-sync",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "obsidian-sync",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "license": "MIT",
       "dependencies": {
         "diff3": "^0.0.4",
         "isomorphic-git": "^1.38.5",
-        "js-yaml": "^4.1.0"
+        "js-yaml": "^4.2.0"
       },
       "devDependencies": {
         "@types/js-yaml": "^4.0.9",
@@ -5114,9 +5114,19 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
diff --git a/package.json b/package.json
index b9586b7..806b6c0 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "obsidian-sync",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Sync your vault to a private memory that any AI reads and writes over MCP: Claude, ChatGPT, Cursor, and any MCP client share the same Markdown you own.",
   "private": true,
   "type": "module",
@@ -57,6 +57,6 @@
   "dependencies": {
     "diff3": "^0.0.4",
     "isomorphic-git": "^1.38.5",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.2.0"
   }
 }
diff --git a/versions.json b/versions.json
index 1873834..91dc00b 100644
--- a/versions.json
+++ b/versions.json
@@ -7,5 +7,6 @@
 	"0.1.5": "1.11.4",
 	"0.1.6": "1.11.4",
 	"0.2.0": "1.11.4",
-	"0.2.1": "1.11.4"
+	"0.2.1": "1.11.4",
+	"0.2.2": "1.11.4"
 }