diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 1543b83..42bb3c7 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -20,9 +20,18 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Build
-        run: docker build -t ${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }} -f Containerfile .
+        run: docker build --squash -t ${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }} -f Containerfile .
 
       - name: Push
         run: |
           echo "${{ secrets.OCI_PASSWD }}" | docker login ${{ vars.OCI_REGISTRY }} -u gitea --password-stdin
           docker push ${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }}
+          
+      - name: Sign
+        env:
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PW }}
+        run: |
+          echo "${{ secrets.COSIGN_KEY }}" > cosign.key
+          DIGEST=$(skopeo inspect --format '{{.Digest}}' docker://${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }})
+          cosign sign --yes --key cosign.key "${{ vars.OCI_REGISTRY }}/drath/dev-toolbx:${{ matrix.variant }}@${DIGEST}"
+