diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index ff567d0..3bec672 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -46,7 +46,7 @@ Match Oxfmt/Oxlint; prefer **straight-line code** and extracted helpers over lon
 
 ### Releases
 
-[@changesets/cli](https://github.com/changesets/changesets) — run **`bunx changeset`** when your PR should bump the version, and commit the `.changeset/*.md` file. The Release workflow opens a "Version packages" PR and publishes to npm on merge via trusted publishing (GitHub OIDC; no `NPM_TOKEN`).
+[@changesets/cli](https://github.com/changesets/changesets) — run **`bunx changeset`** when your PR should bump the version, and commit the `.changeset/*.md` file. The Release workflow opens a "Version packages" PR and publishes to npm on merge via trusted publishing (GitHub OIDC; no `NPM_TOKEN`); Sigstore provenance is auto-generated.
 
 ### Issues
 
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 4f58d48..7c5f5db 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -7,7 +7,6 @@ Forward-looking plans only — **not** a mirror of `src/`. **Doc index:** [READM
 ## Next
 
 - **Remaining ROI work** — actionable items not yet shipped: TanStack Query bridge, `examples/` workspace, docs site, real-browser + SSR + framework-runtime test matrix, React ergonomics layer, OPFS/SQLite/Cloudflare adapters, playground. Plan: [`plans/remaining-roi.md`](./plans/remaining-roi.md).
-- **npm provenance — verify on next release** — trusted publishing + `publishConfig.provenance: true` shipped (`.github/workflows/release.yml`). On the next changeset merge to `main`, confirm the npm version page shows the Provenance badge (or `npm view @stainless-code/persist@<ver> --json` includes `dist.attestations`), then revoke + delete the legacy `NPM_TOKEN` repo secret.
 - **Upstream TanStack Persist collaboration** — pitch the `persistSource` middleware model (structural `PersistableSource` + first-class hydration lifecycle) to the TanStack Persist maintainers as a merge target, after the stainless-code publish stabilises. Draft: [`plans/upstream-tanstack-pitch.md`](./plans/upstream-tanstack-pitch.md).
 
 ---