diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 60f9fe5..756747d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,6 +31,8 @@ jobs:
           cache: npm
       - run: |
           npm ci --ignore-scripts
+      - name: Verify npm package signatures
+        run: npm audit signatures
       - run: |
           npm run all
       - name: Check all jobs are in all-tests-passed.needs
diff --git a/.github/workflows/update-known-checksums.yml b/.github/workflows/update-known-checksums.yml
index 8d6c260..6bdfff4 100644
--- a/.github/workflows/update-known-checksums.yml
+++ b/.github/workflows/update-known-checksums.yml
@@ -23,7 +23,10 @@ jobs:
         run:
           node dist/update-known-checksums/index.cjs
           src/download/checksum/known-checksums.json ${{ secrets.GITHUB_TOKEN }}
-      - run: npm ci --ignore-scripts && npm run all
+      - run: |
+          npm ci --ignore-scripts
+          npm audit signatures
+          npm run all
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with: