diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2221d447..ac2703c3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -34,6 +34,8 @@ jobs:
           cache: npm
       - run: |
           npm ci --ignore-scripts
+      - name: Verify npm package signatures
+        run: npm audit signatures
       - run: |
           npm run all
       - name: Check all jobs are in all-tests-passed.needs
diff --git a/.github/workflows/update-known-checksums.yml b/.github/workflows/update-known-checksums.yml
index 40a0d689..352e6ff7 100644
--- a/.github/workflows/update-known-checksums.yml
+++ b/.github/workflows/update-known-checksums.yml
@@ -38,7 +38,10 @@ jobs:
           fi
       - name: Compile changes
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
-        run: npm ci --ignore-scripts && npm run all
+        run: |
+          npm ci --ignore-scripts
+          npm audit signatures
+          npm run all
       - name: Create Pull Request
         if: ${{ steps.changes-exist.outputs.changes-exist == 'true' }}
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1