diff --git a/README.md b/README.md
index f1a335d..6fe21be 100644
--- a/README.md
+++ b/README.md
@@ -102,6 +102,14 @@ The `package` folder of the repository holds exactly the files needed to run, wi
 
 Both guides also exist as a single HTML file with a light and a dark theme (`package/docs/ExchangeMailboxMigration-UserGuide.html`, `package/docs/ExchangeMailboxMigration-Guide.html`): download them and open them locally, or use the copies in the release zip.
 
+## Release integrity
+
+The public repository protects `main` with pull requests, the required Windows PowerShell 5.1 validation, and no deletion or non-fast-forward updates. Published `v*` tags are also protected against updates and deletion.
+
+The workflow [.github/workflows/attest-release.yml](.github/workflows/attest-release.yml) creates a GitHub artifact attestation for the exact ZIP assets of a published release. It can be run manually from `main` with an explicit tag for an existing release. This attestation binds the distributed ZIP bytes to this repository and workflow; it is not an Authenticode signature and does not replace source review or the existing tests.
+
+`v2.0.0` and its ZIP are already published and immutable. This version is not replaced or retagged. A future release containing Authenticode-signed runtime scripts must use a new version and a new `v*` tag.
+
 ## Tests
 
 ```powershell
diff --git a/package/README.md b/package/README.md
index 430ff5d..de7790b 100644
--- a/package/README.md
+++ b/package/README.md
@@ -48,6 +48,14 @@ notepad .\config\ExchangeMailboxMigration.config.psd1      # Databases: source a
 - [User guide](docs/ExchangeMailboxMigration-UserGuide.md) - the path step by step, also `docs/ExchangeMailboxMigration-UserGuide.html`, a single file to open locally
 - [Developer guide](docs/ExchangeMailboxMigration-Guide.md) - everything else, also `docs/ExchangeMailboxMigration-Guide.html`, a single file to open locally
 
+## Release integrity
+
+Download releases only from the official project page. The `main` branch is protected by pull requests and the required Windows PowerShell 5.1 validation, and published `v*` tags cannot be changed or deleted.
+
+The project publishes GitHub artifact attestations for release ZIP assets with [the attestation workflow](https://github.com/Nico77600/ExchangeMailboxMigration/blob/main/.github/workflows/attest-release.yml). An attestation binds the exact distributed ZIP bytes to this repository and workflow; it is not an Authenticode signature.
+
+The `v2.0.0` tag and ZIP are already published and immutable. A future ZIP with Authenticode-signed runtime scripts must use a new version rather than replacing this release.
+
 Project page, releases and change log: https://github.com/Nico77600/ExchangeMailboxMigration
 
 License: [MIT](LICENSE).