diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index e4f7a2d..8b1a38c 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -439,6 +439,9 @@ jobs:
           subject-name: ${{ steps.prepare.outputs.image }}
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
+          # Storage records (org artifact metadata) need artifact-metadata: write
+          # from every caller; we don't use them, so don't create one.
+          create-storage-record: false
 
       - name: Install cosign
         if: steps.push.outputs.published == 'true' && inputs.cosign
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3d6298..d038ccc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## v1.1.2
+
+- `docker-publish.yml`: the provenance attestation no longer tries to create an artifact storage record. That needed `artifact-metadata: write` from every caller and only produced a warning; the attestation itself is unchanged.
+
 ## v1.1.1
 
 - Callers use the moving `@v1` tag again, as in v1.0. v1.1.0 asked for a commit SHA per caller, which meant a pull request in every repository for each release. `templates/zizmor.yml` allows a tag for `privacybydesign/*` again and still requires a SHA for every other action.