diff --git a/.github/workflows/build-and-push.yml b/.github/workflows/build-and-push.yml
index 14f9e46..737789f 100644
--- a/.github/workflows/build-and-push.yml
+++ b/.github/workflows/build-and-push.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/${{ matrix.arch }}
@@ -45,6 +45,24 @@ jobs:
           tags: |
             fedorapython/fedora-python-tox:${{ matrix.arch }}
             fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}
+      - name: Verify single-platform image
+        run: |
+          # Inspect the manifest
+          manifest=$(docker manifest inspect fedorapython/fedora-python-tox:${{ matrix.arch }})
+
+          # For single-platform images, manifests should be null
+          # For multi-platform or images with attestations, manifests is an array
+          manifests=$(echo "$manifest" | jq '.manifests')
+
+          if [ "$manifests" != "null" ]; then
+            manifest_count=$(echo "$manifests" | jq '. | length')
+            echo "ERROR: Image has a manifest list with $manifest_count entries (expected null for single-platform)!"
+            echo "This usually means attestations are enabled or it's a multi-platform image."
+            echo "$manifests" | jq '.[] | {platform: .platform, digest: .digest, annotations: .annotations}'
+            exit 1
+          fi
+
+          echo "✓ Verified: Image is single-platform (manifests: null)"
       - name: Test local project
         env:
           TOXENV: ${{ matrix.toxenv }}