diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml
index cefb44c66..d1d97dd1b 100644
--- a/.github/workflows/release-binaries.yaml
+++ b/.github/workflows/release-binaries.yaml
@@ -309,7 +309,7 @@ jobs:
       # pre-enable check in CONTRIBUTING for that reason. Nothing in this job
       # compiles: it receives finished tarballs from jobs that cannot write.
       contents: write
-      # Build provenance for the cortex-cpex tarballs (actions/attest-build-provenance).
+      # Build provenance for every tarball (actions/attest-build-provenance).
       id-token: write
       attestations: write
     env:
@@ -357,12 +357,12 @@ jobs:
           ls -l dist
           cat dist/checksums.txt
 
-      - name: Attest build provenance for cortex-cpex
+      - name: Attest build provenance
         # Same condition as the publish step: a dry run attests nothing.
         if: github.event_name == 'push'
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
         with:
-          subject-path: dist/cortex-cpex_*.tar.gz
+          subject-path: dist/*.tar.gz
 
       - name: Publish to GitHub Release
         # A main push publishes too, which is the whole point of the channel; the
@@ -411,8 +411,9 @@ jobs:
           fi
           add 'Prebuilt `agentop` and `cortex` binaries for linux and macOS (amd64/arm64).'
           add '`cortex-cpex_*` is `cortex` built with the cpex policy plugin, for macOS arm64 and'
-          add 'linux amd64/arm64 (static). Install it with `install.sh --cpex`; its provenance'
-          add 'verifies with `gh attestation verify <tarball> --repo rossoctl/cortex`.'
+          add 'linux amd64/arm64 (static). Install it with `install.sh --cpex`.'
+          add 'Every tarball carries build provenance:'
+          add '`gh attestation verify <tarball> --repo rossoctl/cortex`.'
           add ''
           # The rename shipped with no alias, so it has to be said somewhere a v0.7.0
           # user will look. Drop this once no supported release predates it.
diff --git a/CLAUDE.md b/CLAUDE.md
index ec4c53954..5173f90cc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -373,7 +373,7 @@ darwin/amd64 FFI. The executable inside is still `cortex`, and `cortex
 --version` prints `cortex (cpex) <ver>`. The workflow's jobs are `version`,
 `build`, `build-cpex` (both `contents: read`) and `publish`, which alone
 writes, refuses to publish unless every expected tarball arrived, writes one
-`checksums.txt` over all of them, and attests the cpex tarballs' build
+`checksums.txt` over all of them, and attests every tarball's build
 provenance. `install.sh --cpex` installs it; `make cortex-cpex` builds the same
 thing locally to `bin/cortex-cpex/cortex`.
 
diff --git a/docs/laptop-service.md b/docs/laptop-service.md
index 630b4ea57..4c19cb357 100644
--- a/docs/laptop-service.md
+++ b/docs/laptop-service.md
@@ -136,8 +136,8 @@ cortex --version                                         # cortex (cpex) v0.9.3
 curl -s http://127.0.0.1:47601/v1/plugins | grep -c '"name":"cpex"'   # 1
 ```
 
-The tarballs carry build provenance as well as their `checksums.txt` entry:
-`gh attestation verify cortex-cpex_<version>_<os>_<arch>.tar.gz --repo rossoctl/cortex`.
+Every release tarball, cpex or not, carries build provenance as well as its `checksums.txt`
+entry: `gh attestation verify <tarball> --repo rossoctl/cortex`.
 
 The choice is not remembered. Re-running the installer without `--cpex` installs the
 default build again, and says so first; keep passing `--cpex` to stay on it. Against a