diff --git a/cmd/validate/image.go b/cmd/validate/image.go
index 99b70ea21..334193fd8 100644
--- a/cmd/validate/image.go
+++ b/cmd/validate/image.go
@@ -21,7 +21,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
+	"path/filepath"
 	"runtime/trace"
+	"slices"
 	"strings"
 	"time"
 
@@ -50,40 +53,7 @@ type imageValidationFunc func(context.Context, app.SnapshotComponent, *app.Snaps
 var newOPAEvaluator = evaluator.NewOPAEvaluator
 
 func validateImageCmd(validate imageValidationFunc) *cobra.Command {
-	data := struct {
-		certificateIdentity         string
-		certificateIdentityRegExp   string
-		certificateOIDCIssuer       string
-		certificateOIDCIssuerRegExp string
-		effectiveTime               string
-		extraRuleData               []string
-		filePath                    string // Deprecated: images replaced this
-		filterType                  string
-		imageRef                    string
-		info                        bool
-		input                       string // Deprecated: images replaced this
-		ignoreRekor                 bool
-		output                      []string
-		outputFile                  string
-		policy                      policy.Policy
-		policyConfiguration         string
-		policySource                string
-		publicKey                   string
-		rekorURL                    string
-		snapshot                    string
-		spec                        *app.SnapshotSpec
-		// Only used to pass the expansion info to the report. Not a cli flag.
-		expansion     *applicationsnapshot.ExpansionInfo
-		strict        bool
-		images        string
-		noColor       bool
-		forceColor    bool
-		workers       int
-		vsaEnabled    bool
-		vsaSigningKey string
-		vsaUpload     []string
-		vsaExpiration time.Duration
-	}{
+	data := &imageData{
 		strict:        true,
 		workers:       5,
 		filterType:    "include-exclude", // Default to include-exclude filter
@@ -309,6 +279,19 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 				data.policy = p
 			}
 
+			// Validate VSA configuration
+			if data.vsaEnabled {
+				if !slices.Contains([]string{"dsse", "predicate"}, data.attestationFormat) {
+					allErrors = errors.Join(allErrors, fmt.Errorf("invalid --attestation-format: %s (valid: dsse, predicate)", data.attestationFormat))
+				}
+				if data.attestationFormat == "dsse" && data.vsaSigningKey == "" {
+					allErrors = errors.Join(allErrors, fmt.Errorf("--vsa-signing-key required for --attestation-format=dsse"))
+				}
+				if data.attestationFormat == "predicate" && data.vsaSigningKey != "" {
+					log.Warn("--vsa-signing-key is ignored for --attestation-format=predicate")
+				}
+			}
+
 			return
 		},
 
@@ -457,77 +440,21 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 			}
 
 			if data.vsaEnabled {
-				// Use the signer function that supports both file and k8s:// URLs
-				signer, err := vsa.NewSigner(cmd.Context(), data.vsaSigningKey, utils.FS(cmd.Context()))
+				// Validate and get output directory
+				outputDir, err := validateAttestationOutputPath(data.attestationOutputDir)
 				if err != nil {
-					log.Error(err)
-					return err
-				}
-
-				// Create VSA service
-				vsaService := vsa.NewServiceWithFS(signer, utils.FS(cmd.Context()), data.policySource, data.policy)
-
-				// Define helper functions for getting git URL and digest
-				getGitURL := func(comp applicationsnapshot.Component) string {
-					if comp.Source.GitSource != nil {
-						return comp.Source.GitSource.URL
-					}
-					return ""
+					return fmt.Errorf("invalid attestation output directory: %w", err)
 				}
 
-				getDigest := func(comp applicationsnapshot.Component) (string, error) {
-					imageRef, err := name.ParseReference(comp.ContainerImage)
-					if err != nil {
-						return "", fmt.Errorf("failed to parse image reference %s: %v", comp.ContainerImage, err)
+				// Dispatch to appropriate method based on format
+				switch data.attestationFormat {
+				case "dsse":
+					if err := data.generateVSAsDSSE(cmd, report, outputDir); err != nil {
+						return err
 					}
-
-					digest, err := oci.NewClient(cmd.Context()).ResolveDigest(imageRef)
-					if err != nil {
-						return "", fmt.Errorf("failed to resolve digest for image %s: %v", comp.ContainerImage, err)
-					}
-
-					return digest, nil
-				}
-
-				// Process all VSAs using the service
-				vsaResult, err := vsaService.ProcessAllVSAs(cmd.Context(), report, getGitURL, getDigest)
-				if err != nil {
-					log.Errorf("Failed to process VSAs: %v", err)
-					// Don't return error here, continue with the rest of the command
-				} else {
-					// Upload VSAs to configured storage backends
-					if len(data.vsaUpload) > 0 {
-						log.Infof("[VSA] Starting upload to %d storage backend(s)", len(data.vsaUpload))
-
-						// Upload component VSA envelopes
-						for imageRef, envelopePath := range vsaResult.ComponentEnvelopes {
-							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), envelopePath, data.vsaUpload, signer)
-							if uploadErr != nil {
-								log.Errorf("[VSA] Upload failed for component %s: %v", imageRef, uploadErr)
-							} else {
-								log.Infof("[VSA] Uploaded Component VSA")
-							}
-						}
-
-						// Upload snapshot VSA envelope if it exists
-						if vsaResult.SnapshotEnvelope != "" {
-							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), vsaResult.SnapshotEnvelope, data.vsaUpload, signer)
-							if uploadErr != nil {
-								log.Errorf("[VSA] Upload failed for snapshot: %v", uploadErr)
-							} else {
-								log.Infof("[VSA] Uploaded Snapshot VSA")
-							}
-						}
-					} else {
-						// No upload backends configured - inform user about next steps
-						totalFiles := len(vsaResult.ComponentEnvelopes)
-						if vsaResult.SnapshotEnvelope != "" {
-							totalFiles++
-						}
-
-						if totalFiles > 0 {
-							log.Errorf("[VSA] VSA files generated but not uploaded (no --vsa-upload backends specified)")
-						}
+				case "predicate":
+					if err := data.generateVSAsPredicates(cmd, report, outputDir); err != nil {
+						return err
 					}
 				}
 			}
@@ -630,9 +557,11 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 		- "ec-policy": Uses Enterprise Contract policy filtering with pipeline intention support`))
 
 	cmd.Flags().BoolVar(&data.vsaEnabled, "vsa", false, "Generate a Verification Summary Attestation (VSA) for each validated image.")
+	cmd.Flags().StringVar(&data.attestationFormat, "attestation-format", "dsse", "Attestation output format: dsse (signed envelope), predicate (raw JSON)")
 	cmd.Flags().StringVar(&data.vsaSigningKey, "vsa-signing-key", "", "Path to the private key for signing the VSA. Supports file paths and Kubernetes secret references (k8s://namespace/secret-name/key-field).")
 	cmd.Flags().StringSliceVar(&data.vsaUpload, "vsa-upload", nil, "Storage backends for VSA upload. Format: backend@url?param=value. Examples: rekor@https://rekor.sigstore.dev, local@./vsa-dir")
 	cmd.Flags().DurationVar(&data.vsaExpiration, "vsa-expiration", data.vsaExpiration, "Expiration threshold for existing VSAs. If a valid VSA exists and is newer than this threshold, validation will be skipped. (default 168h)")
+	cmd.Flags().StringVar(&data.attestationOutputDir, "attestation-output-dir", "", "Directory for attestation output files. Defaults to a temp directory under /tmp. Must be under /tmp or the current working directory.")
 
 	if len(data.input) > 0 || len(data.filePath) > 0 || len(data.images) > 0 {
 		if err := cmd.MarkFlagRequired("image"); err != nil {
@@ -643,4 +572,179 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 	return cmd
 }
 
+// validateAttestationOutputPath validates and returns the absolute path for attestation output.
+// If path is empty, defaults to a temp directory under /tmp with "vsa-" prefix.
+// If path is provided, validates it's under /tmp or current working directory.
+func validateAttestationOutputPath(path string) (string, error) {
+	// Default to temp directory if not provided
+	if path == "" {
+		return "vsa-", nil
+	}
+
+	// Clean and get absolute path
+	cleanPath := filepath.Clean(path)
+	absPath, err := filepath.Abs(cleanPath)
+	if err != nil {
+		return "", fmt.Errorf("failed to get absolute path for %s: %w", path, err)
+	}
+
+	// Get current working directory
+	cwd, err := os.Getwd()
+	if err != nil {
+		return "", fmt.Errorf("failed to get current working directory: %w", err)
+	}
+
+	// Check if path is under /tmp
+	tmpDir := filepath.Clean("/tmp")
+	if strings.HasPrefix(absPath, tmpDir+string(filepath.Separator)) || absPath == tmpDir {
+		return absPath, nil
+	}
+
+	// Check if path is under current working directory
+	if strings.HasPrefix(absPath, cwd+string(filepath.Separator)) || absPath == cwd {
+		return absPath, nil
+	}
+
+	return "", fmt.Errorf("attestation output directory must be under /tmp or current working directory, got: %s", absPath)
+}
+
+// imageData is the struct that holds all image validation command data
+type imageData struct {
+	certificateIdentity         string
+	certificateIdentityRegExp   string
+	certificateOIDCIssuer       string
+	certificateOIDCIssuerRegExp string
+	effectiveTime               string
+	extraRuleData               []string
+	filePath                    string
+	filterType                  string
+	imageRef                    string
+	info                        bool
+	input                       string
+	ignoreRekor                 bool
+	output                      []string
+	outputFile                  string
+	policy                      policy.Policy
+	policyConfiguration         string
+	policySource                string
+	publicKey                   string
+	rekorURL                    string
+	snapshot                    string
+	spec                        *app.SnapshotSpec
+	expansion                   *applicationsnapshot.ExpansionInfo
+	strict                      bool
+	images                      string
+	noColor                     bool
+	forceColor                  bool
+	workers                     int
+	vsaEnabled                  bool
+	attestationFormat           string
+	vsaSigningKey               string
+	vsaUpload                   []string
+	vsaExpiration               time.Duration
+	attestationOutputDir        string
+}
+
+// generateVSAsDSSE generates DSSE VSA envelopes for all validated components
+func (data *imageData) generateVSAsDSSE(cmd *cobra.Command, report applicationsnapshot.Report, outputDir string) error {
+	// Use service for DSSE envelopes
+	signer, err := vsa.NewSigner(cmd.Context(), data.vsaSigningKey, utils.FS(cmd.Context()))
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+
+	// Create VSA service with output directory
+	vsaService := vsa.NewServiceWithFS(signer, utils.FS(cmd.Context()), data.policySource, data.policy, outputDir)
+
+	// Define helper functions for getting git URL and digest
+	getGitURL := func(comp applicationsnapshot.Component) string {
+		if comp.Source.GitSource != nil {
+			return comp.Source.GitSource.URL
+		}
+		return ""
+	}
+
+	getDigest := func(comp applicationsnapshot.Component) (string, error) {
+		imageRef, err := name.ParseReference(comp.ContainerImage)
+		if err != nil {
+			return "", fmt.Errorf("failed to parse image reference %s: %v", comp.ContainerImage, err)
+		}
+
+		digest, err := oci.NewClient(cmd.Context()).ResolveDigest(imageRef)
+		if err != nil {
+			return "", fmt.Errorf("failed to resolve digest for image %s: %v", comp.ContainerImage, err)
+		}
+
+		return digest, nil
+	}
+
+	// Process all VSAs using the service
+	vsaResult, err := vsaService.ProcessAllVSAs(cmd.Context(), report, getGitURL, getDigest)
+	if err != nil {
+		log.Errorf("Failed to process VSAs: %v", err)
+		// Don't return error here, continue with the rest of the command
+	} else {
+		// Upload VSAs to configured storage backends
+		if len(data.vsaUpload) > 0 {
+			log.Infof("[VSA] Starting upload to %d storage backend(s)", len(data.vsaUpload))
+
+			// Upload component VSA envelopes
+			for imageRef, envelopePath := range vsaResult.ComponentEnvelopes {
+				uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), envelopePath, data.vsaUpload, signer)
+				if uploadErr != nil {
+					log.Errorf("[VSA] Upload failed for component %s: %v", imageRef, uploadErr)
+				} else {
+					log.Infof("[VSA] Uploaded Component VSA")
+				}
+			}
+
+			// Upload snapshot VSA envelope if it exists
+			if vsaResult.SnapshotEnvelope != "" {
+				uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), vsaResult.SnapshotEnvelope, data.vsaUpload, signer)
+				if uploadErr != nil {
+					log.Errorf("[VSA] Upload failed for snapshot: %v", uploadErr)
+				} else {
+					log.Infof("[VSA] Uploaded Snapshot VSA")
+				}
+			}
+		} else {
+			// No upload backends configured - inform user about next steps
+			totalFiles := len(vsaResult.ComponentEnvelopes)
+			if vsaResult.SnapshotEnvelope != "" {
+				totalFiles++
+			}
+
+			if totalFiles > 0 {
+				log.Errorf("[VSA] VSA files generated but not uploaded (no --vsa-upload backends specified)")
+			}
+		}
+	}
+
+	return nil
+}
+
+// generateVSAsPredicates generates raw VSA predicates for all validated components
+func (data *imageData) generateVSAsPredicates(cmd *cobra.Command, report applicationsnapshot.Report, outputDir string) error {
+	for _, comp := range report.Components {
+		generator := vsa.NewGenerator(report, comp, data.policySource, data.policy)
+
+		writer := &vsa.Writer{
+			FS:            utils.FS(cmd.Context()),
+			TempDirPrefix: outputDir,
+			FilePerm:      0o600,
+		}
+
+		predicatePath, err := vsa.GenerateAndWritePredicate(cmd.Context(), generator, writer)
+		if err != nil {
+			log.Errorf("Failed to generate predicate for %s: %v", comp.ContainerImage, err)
+			continue
+		}
+
+		log.Infof("[VSA] Generated predicate for %s at %s", comp.ContainerImage, predicatePath)
+	}
+
+	return nil
+}
+
 // find if the slice contains "value" output
diff --git a/cmd/validate/image_test.go b/cmd/validate/image_test.go
index fd90c295e..f149dcd7b 100644
--- a/cmd/validate/image_test.go
+++ b/cmd/validate/image_test.go
@@ -29,6 +29,8 @@ import (
 	"fmt"
 	"io"
 	"math/big"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -1632,3 +1634,563 @@ func TestValidateImageCommand_ShowWarningsFlag(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateImageCommand_VSAFormat_DSSE(t *testing.T) {
+	// Test that --attestation-format=dsse generates DSSE envelopes (existing behavior)
+	t.Setenv("COSIGN_PASSWORD", "")
+
+	// Mock the expensive loadPrivateKey operation
+	originalLoadPrivateKey := vsa.LoadPrivateKey
+	defer func() { vsa.LoadPrivateKey = originalLoadPrivateKey }()
+
+	vsa.LoadPrivateKey = func(keyBytes, password []byte) (signature.SignerVerifier, error) {
+		return &simpleFakeSigner{}, nil
+	}
+
+	validateImageCmd := validateImageCmd(happyValidator())
+	cmd := setUpCobra(validateImageCmd)
+
+	fs := afero.NewMemMapFs()
+	ctx := utils.WithFS(context.Background(), fs)
+
+	// Create a test VSA signing key
+	err := afero.WriteFile(fs, "/tmp/vsa-key.pem", []byte(testECKey), 0600)
+	require.NoError(t, err)
+
+	client := fake.FakeClient{}
+	commonMockClient(&client)
+
+	// Add ResolveDigest expectation for VSA processing
+	digest, _ := name.NewDigest(testImageDigest)
+	client.On("ResolveDigest", mock.Anything).Return(digest.String(), nil)
+
+	ctx = oci.WithClient(ctx, &client)
+	cmd.SetContext(ctx)
+
+	cmd.SetArgs([]string{
+		"validate", "image",
+		"--image", "registry/image:tag",
+		"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+		"--vsa",
+		"--attestation-format", "dsse",
+		"--vsa-signing-key", "/tmp/vsa-key.pem",
+		"--vsa-upload", "local@/tmp/vsa-test",
+	})
+
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+
+	utils.SetTestRekorPublicKey(t)
+
+	// Execute - the command should attempt to generate DSSE envelopes
+	_ = cmd.Execute()
+	// We don't assert no error because VSA generation might fail in test environment,
+	// but we're testing that the DSSE code path is executed
+}
+
+func TestValidateImageCommand_VSAFormat_Predicate(t *testing.T) {
+	// Test that --attestation-format=predicate generates raw predicates
+	t.Setenv("COSIGN_PASSWORD", "")
+
+	validateImageCmd := validateImageCmd(happyValidator())
+	cmd := setUpCobra(validateImageCmd)
+
+	fs := afero.NewMemMapFs()
+	ctx := utils.WithFS(context.Background(), fs)
+
+	client := fake.FakeClient{}
+	commonMockClient(&client)
+
+	ctx = oci.WithClient(ctx, &client)
+	cmd.SetContext(ctx)
+
+	cmd.SetArgs([]string{
+		"validate", "image",
+		"--image", "registry/image:tag",
+		"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+		"--vsa",
+		"--attestation-format", "predicate",
+		"--vsa-upload", "local@/tmp/vsa-predicates",
+	})
+
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+
+	utils.SetTestRekorPublicKey(t)
+
+	// Execute - the command should attempt to generate predicates
+	_ = cmd.Execute()
+	// We don't assert no error because predicate generation might fail in test environment,
+	// but we're testing that the predicate code path is executed
+}
+
+func TestValidateImageCommand_VSAFormat_InvalidFormat(t *testing.T) {
+	// Test that validation rejects invalid formats
+	validateImageCmd := validateImageCmd(happyValidator())
+	cmd := setUpCobra(validateImageCmd)
+
+	fs := afero.NewMemMapFs()
+	ctx := utils.WithFS(context.Background(), fs)
+
+	client := fake.FakeClient{}
+	commonMockClient(&client)
+
+	ctx = oci.WithClient(ctx, &client)
+	cmd.SetContext(ctx)
+
+	cmd.SetArgs([]string{
+		"validate", "image",
+		"--image", "registry/image:tag",
+		"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+		"--vsa",
+		"--attestation-format", "invalid-format",
+		"--vsa-signing-key", "/tmp/vsa-key.pem",
+		"--vsa-upload", "local@/tmp/vsa-test",
+	})
+
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	utils.SetTestRekorPublicKey(t)
+
+	err := cmd.Execute()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid --attestation-format: invalid-format")
+	assert.Contains(t, err.Error(), "(valid: dsse, predicate)")
+}
+
+func TestValidateImageCommand_VSAFormat_DSSE_RequiresSigningKey(t *testing.T) {
+	// Test that --attestation-format=dsse requires --vsa-signing-key
+	validateImageCmd := validateImageCmd(happyValidator())
+	cmd := setUpCobra(validateImageCmd)
+
+	fs := afero.NewMemMapFs()
+	ctx := utils.WithFS(context.Background(), fs)
+
+	client := fake.FakeClient{}
+	commonMockClient(&client)
+
+	ctx = oci.WithClient(ctx, &client)
+	cmd.SetContext(ctx)
+
+	cmd.SetArgs([]string{
+		"validate", "image",
+		"--image", "registry/image:tag",
+		"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+		"--vsa",
+		"--attestation-format", "dsse",
+		// Missing --vsa-signing-key
+		"--vsa-upload", "local@/tmp/vsa-test",
+	})
+
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+	cmd.SilenceErrors = true
+	cmd.SilenceUsage = true
+
+	utils.SetTestRekorPublicKey(t)
+
+	err := cmd.Execute()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "--vsa-signing-key required for --attestation-format=dsse")
+}
+
+func TestValidateImageCommand_VSAFormat_Predicate_WorksWithoutSigningKey(t *testing.T) {
+	// Test that --attestation-format=predicate works without signing key
+	t.Setenv("COSIGN_PASSWORD", "")
+
+	validateImageCmd := validateImageCmd(happyValidator())
+	cmd := setUpCobra(validateImageCmd)
+
+	fs := afero.NewMemMapFs()
+	ctx := utils.WithFS(context.Background(), fs)
+
+	client := fake.FakeClient{}
+	commonMockClient(&client)
+
+	ctx = oci.WithClient(ctx, &client)
+	cmd.SetContext(ctx)
+
+	cmd.SetArgs([]string{
+		"validate", "image",
+		"--image", "registry/image:tag",
+		"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+		"--vsa",
+		"--attestation-format", "predicate",
+		// No --vsa-signing-key provided
+		"--vsa-upload", "local@/tmp/vsa-predicates",
+	})
+
+	var out bytes.Buffer
+	cmd.SetOut(&out)
+
+	utils.SetTestRekorPublicKey(t)
+
+	// Execute - the command should work without signing key for predicate format
+	_ = cmd.Execute()
+	// We don't assert no error because predicate generation might fail in test environment,
+	// but we're testing that it doesn't fail due to missing signing key
+}
+
+func TestValidateAttestationOutputPath(t *testing.T) {
+	// Get current working directory for tests
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	tests := []struct {
+		name        string
+		path        string
+		expected    string
+		shouldError bool
+		errorMsg    string
+	}{
+		{
+			name:     "empty path defaults to vsa- prefix",
+			path:     "",
+			expected: "vsa-",
+		},
+		{
+			name:     "/tmp path is allowed",
+			path:     "/tmp/vsa-test",
+			expected: "/tmp/vsa-test",
+		},
+		{
+			name:     "/tmp itself is allowed",
+			path:     "/tmp",
+			expected: "/tmp",
+		},
+		{
+			name:     "relative path under cwd is allowed",
+			path:     "./vsa-output",
+			expected: filepath.Join(cwd, "vsa-output"),
+		},
+		{
+			name:     "subdirectory under cwd is allowed",
+			path:     "vsa-output",
+			expected: filepath.Join(cwd, "vsa-output"),
+		},
+		{
+			name:        "/etc path is rejected",
+			path:        "/etc/vsa",
+			shouldError: true,
+			errorMsg:    "attestation output directory must be under /tmp or current working directory",
+		},
+		{
+			name:        "/var path is rejected",
+			path:        "/var/vsa",
+			shouldError: true,
+			errorMsg:    "attestation output directory must be under /tmp or current working directory",
+		},
+		{
+			name:        "root path is rejected",
+			path:        "/",
+			shouldError: true,
+			errorMsg:    "attestation output directory must be under /tmp or current working directory",
+		},
+		{
+			name:     "path with .. under cwd is allowed after cleaning",
+			path:     "./foo/../vsa",
+			expected: filepath.Join(cwd, "vsa"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := validateAttestationOutputPath(tt.path)
+
+			if tt.shouldError {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errorMsg)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.expected, result)
+			}
+		})
+	}
+}
+
+// TestGenerateVSAsDSSE_Errors tests error paths in generateVSAsDSSE
+func TestGenerateVSAsDSSE_Errors(t *testing.T) {
+	t.Setenv("COSIGN_PASSWORD", "")
+
+	t.Run("invalid signing key", func(t *testing.T) {
+		validateImageCmd := validateImageCmd(happyValidator())
+		cmd := setUpCobra(validateImageCmd)
+
+		fs := afero.NewMemMapFs()
+		ctx := utils.WithFS(context.Background(), fs)
+
+		// Create invalid signing key file
+		err := afero.WriteFile(fs, "/tmp/invalid-key.pem", []byte("invalid key content"), 0600)
+		require.NoError(t, err)
+
+		client := fake.FakeClient{}
+		commonMockClient(&client)
+		ctx = oci.WithClient(ctx, &client)
+		cmd.SetContext(ctx)
+
+		cmd.SetArgs([]string{
+			"validate", "image",
+			"--image", "registry/image:tag",
+			"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+			"--vsa",
+			"--attestation-format", "dsse",
+			"--vsa-signing-key", "/tmp/invalid-key.pem",
+			"--vsa-upload", "local@/tmp/vsa-test",
+		})
+
+		var out bytes.Buffer
+		cmd.SetOut(&out)
+		cmd.SilenceErrors = true
+		cmd.SilenceUsage = true
+
+		utils.SetTestRekorPublicKey(t)
+
+		err = cmd.Execute()
+		assert.Error(t, err)
+		// The error should be related to key loading
+	})
+
+	t.Run("missing signing key file", func(t *testing.T) {
+		validateImageCmd := validateImageCmd(happyValidator())
+		cmd := setUpCobra(validateImageCmd)
+
+		fs := afero.NewMemMapFs()
+		ctx := utils.WithFS(context.Background(), fs)
+
+		client := fake.FakeClient{}
+		commonMockClient(&client)
+		ctx = oci.WithClient(ctx, &client)
+		cmd.SetContext(ctx)
+
+		cmd.SetArgs([]string{
+			"validate", "image",
+			"--image", "registry/image:tag",
+			"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+			"--vsa",
+			"--attestation-format", "dsse",
+			"--vsa-signing-key", "/tmp/nonexistent-key.pem",
+			"--vsa-upload", "local@/tmp/vsa-test",
+		})
+
+		var out bytes.Buffer
+		cmd.SetOut(&out)
+		cmd.SilenceErrors = true
+		cmd.SilenceUsage = true
+
+		utils.SetTestRekorPublicKey(t)
+
+		err := cmd.Execute()
+		assert.Error(t, err)
+		// The error should be related to file not found
+	})
+
+	t.Run("successful VSA generation with uploads", func(t *testing.T) {
+		// Mock the expensive loadPrivateKey operation
+		originalLoadPrivateKey := vsa.LoadPrivateKey
+		defer func() { vsa.LoadPrivateKey = originalLoadPrivateKey }()
+
+		vsa.LoadPrivateKey = func(keyBytes, password []byte) (signature.SignerVerifier, error) {
+			return &simpleFakeSigner{}, nil
+		}
+
+		validateImageCmd := validateImageCmd(happyValidator())
+		cmd := setUpCobra(validateImageCmd)
+
+		fs := afero.NewMemMapFs()
+		ctx := utils.WithFS(context.Background(), fs)
+
+		// Create a test VSA signing key
+		err := afero.WriteFile(fs, "/tmp/vsa-key.pem", []byte(testECKey), 0600)
+		require.NoError(t, err)
+
+		client := fake.FakeClient{}
+		commonMockClient(&client)
+
+		// Add missing ResolveDigest expectation for VSA processing
+		digest, _ := name.NewDigest(testImageDigest)
+		client.On("ResolveDigest", mock.Anything).Return(digest.String(), nil)
+
+		ctx = oci.WithClient(ctx, &client)
+		cmd.SetContext(ctx)
+
+		cmd.SetArgs([]string{
+			"validate", "image",
+			"--image", "registry/image:tag",
+			"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+			"--vsa",
+			"--attestation-format", "dsse",
+			"--vsa-signing-key", "/tmp/vsa-key.pem",
+			"--vsa-upload", "local@/tmp/vsa-test",
+		})
+
+		var out bytes.Buffer
+		cmd.SetOut(&out)
+
+		utils.SetTestRekorPublicKey(t)
+
+		// Execute - we expect this to attempt uploads (though they may fail in test environment)
+		_ = cmd.Execute()
+		// We don't assert no error because upload might fail in test environment
+	})
+}
+
+// TestGenerateVSAsPredicates_Errors tests error paths in generateVSAsPredicates
+func TestGenerateVSAsPredicates_Errors(t *testing.T) {
+	t.Run("invalid output directory", func(t *testing.T) {
+		validateImageCmd := validateImageCmd(happyValidator())
+		cmd := setUpCobra(validateImageCmd)
+
+		fs := afero.NewMemMapFs()
+		ctx := utils.WithFS(context.Background(), fs)
+
+		client := fake.FakeClient{}
+		commonMockClient(&client)
+		ctx = oci.WithClient(ctx, &client)
+		cmd.SetContext(ctx)
+
+		cmd.SetArgs([]string{
+			"validate", "image",
+			"--image", "registry/image:tag",
+			"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+			"--vsa",
+			"--attestation-format", "predicate",
+			"--attestation-output-dir", "/etc/invalid-dir", // Invalid directory outside /tmp and cwd
+			"--vsa-upload", "local@/tmp/vsa-predicates",
+		})
+
+		var out bytes.Buffer
+		cmd.SetOut(&out)
+		cmd.SilenceErrors = true
+		cmd.SilenceUsage = true
+
+		utils.SetTestRekorPublicKey(t)
+
+		err := cmd.Execute()
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "attestation output directory must be under /tmp or current working directory")
+	})
+
+	t.Run("write failures with read-only filesystem", func(t *testing.T) {
+		// This test simulates write failures by using a read-only filesystem
+		validateImageCmd := validateImageCmd(happyValidator())
+		cmd := setUpCobra(validateImageCmd)
+
+		// Create a read-only filesystem to simulate write errors
+		fs := afero.NewReadOnlyFs(afero.NewMemMapFs())
+		ctx := utils.WithFS(context.Background(), fs)
+
+		client := fake.FakeClient{}
+		commonMockClient(&client)
+		ctx = oci.WithClient(ctx, &client)
+		cmd.SetContext(ctx)
+
+		cmd.SetArgs([]string{
+			"validate", "image",
+			"--image", "registry/image:tag",
+			"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+			"--vsa",
+			"--attestation-format", "predicate",
+			"--attestation-output-dir", "/tmp/vsa-predicates",
+			"--vsa-upload", "local@/tmp/vsa-predicates",
+		})
+
+		var out bytes.Buffer
+		cmd.SetOut(&out)
+		cmd.SilenceErrors = true
+		cmd.SilenceUsage = true
+
+		utils.SetTestRekorPublicKey(t)
+
+		// The command may fail due to filesystem errors
+		_ = cmd.Execute()
+		// We don't assert specific error here because the error might occur at various stages
+	})
+}
+
+// TestVSAGeneration_WithOutputDir tests the complete VSA generation flow with custom output directory
+func TestVSAGeneration_WithOutputDir(t *testing.T) {
+	t.Setenv("COSIGN_PASSWORD", "")
+
+	// Mock the expensive loadPrivateKey operation
+	originalLoadPrivateKey := vsa.LoadPrivateKey
+	defer func() { vsa.LoadPrivateKey = originalLoadPrivateKey }()
+
+	vsa.LoadPrivateKey = func(keyBytes, password []byte) (signature.SignerVerifier, error) {
+		return &simpleFakeSigner{}, nil
+	}
+
+	tests := []struct {
+		name      string
+		format    string
+		outputDir string
+		needsKey  bool
+	}{
+		{
+			name:      "DSSE format with custom output directory",
+			format:    "dsse",
+			outputDir: "/tmp/test-vsa-dsse",
+			needsKey:  true,
+		},
+		{
+			name:      "predicate format with custom output directory",
+			format:    "predicate",
+			outputDir: "/tmp/test-vsa-predicate",
+			needsKey:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			validateImageCmd := validateImageCmd(happyValidator())
+			cmd := setUpCobra(validateImageCmd)
+
+			fs := afero.NewMemMapFs()
+			ctx := utils.WithFS(context.Background(), fs)
+
+			// Create test VSA signing key if needed
+			if tt.needsKey {
+				err := afero.WriteFile(fs, "/tmp/vsa-key.pem", []byte(testECKey), 0600)
+				require.NoError(t, err)
+			}
+
+			client := fake.FakeClient{}
+			commonMockClient(&client)
+
+			// Add ResolveDigest expectation
+			digest, _ := name.NewDigest(testImageDigest)
+			client.On("ResolveDigest", mock.Anything).Return(digest.String(), nil)
+
+			ctx = oci.WithClient(ctx, &client)
+			cmd.SetContext(ctx)
+
+			args := []string{
+				"validate", "image",
+				"--image", "registry/image:tag",
+				"--policy", fmt.Sprintf(`{"publicKey": %s}`, utils.TestPublicKeyJSON),
+				"--vsa",
+				"--attestation-format", tt.format,
+				"--attestation-output-dir", tt.outputDir,
+				"--vsa-upload", "local@/tmp/vsa-test",
+			}
+
+			if tt.needsKey {
+				args = append(args, "--vsa-signing-key", "/tmp/vsa-key.pem")
+			}
+
+			cmd.SetArgs(args)
+
+			var out bytes.Buffer
+			cmd.SetOut(&out)
+
+			utils.SetTestRekorPublicKey(t)
+
+			// Execute command
+			_ = cmd.Execute()
+			// We don't assert no error because generation might fail in test environment,
+			// but we're testing that the output directory logic is executed correctly
+		})
+	}
+}
diff --git a/docs/modules/ROOT/pages/ec_validate_image.adoc b/docs/modules/ROOT/pages/ec_validate_image.adoc
index 05b1bf823..b44e9446c 100644
--- a/docs/modules/ROOT/pages/ec_validate_image.adoc
+++ b/docs/modules/ROOT/pages/ec_validate_image.adoc
@@ -110,6 +110,8 @@ Use a regular expression to match certificate attributes.
 
 == Options
 
+--attestation-format:: Attestation output format: dsse (signed envelope), predicate (raw JSON) (Default: dsse)
+--attestation-output-dir:: Directory for attestation output files. Defaults to a temp directory under /tmp. Must be under /tmp or the current working directory.
 --certificate-identity:: URL of the certificate identity for keyless verification
 --certificate-identity-regexp:: Regular expression for the URL of the certificate identity for keyless verification
 --certificate-oidc-issuer:: URL of the certificate OIDC issuer for keyless verification
diff --git a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
index ad1168b09..a2523e537 100644
--- a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
+++ b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
@@ -88,8 +88,21 @@ paths can be provided by using the `:` separator.
 *RETRY_MAX_WAIT* (`string`):: Maximum wait time between retries (e.g., "3s", "10s")
 +
 *Default*: `3s`
+*ENABLE_VSA* (`string`):: Enable VSA generation
++
+*Default*: `false`
+*ATTESTATION_FORMAT* (`string`):: Attestation format: dsse (signed envelope) or predicate (raw JSON)
++
+*Default*: `dsse`
+*VSA_SIGNING_KEY* (`string`):: Signing key for format=dsse (k8s:// or file:// URL)
+*VSA_UPLOAD* (`string`):: VSA upload destination
++
+*Default*: `local@/var/workdir/vsa`
+*ociStorage* (`string`):: OCI storage URL for trusted artifacts
 
 == Results
 
 [horizontal]
 *TEST_OUTPUT*:: Short summary of the policy evaluation for each image
+*VSA_GENERATED*:: Whether VSAs were generated (true/false)
+*sourceDataArtifact*:: Trusted Artifact URI containing VSA files
diff --git a/features/__snapshots__/ta_task_validate_image.snap b/features/__snapshots__/ta_task_validate_image.snap
index 687250432..3b50328a5 100755
--- a/features/__snapshots__/ta_task_validate_image.snap
+++ b/features/__snapshots__/ta_task_validate_image.snap
@@ -133,7 +133,8 @@
 
 [Golden container image with trusted artifacts:results - 1]
 {
-  "TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
+  "TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n",
+  "VSA_GENERATED": "false\n"
 }
 ---
 
diff --git a/go.mod b/go.mod
index 9ccc1655f..07498b01d 100644
--- a/go.mod
+++ b/go.mod
@@ -39,7 +39,7 @@ require (
 	github.com/spdx/tools-golang v0.5.5
 	github.com/spf13/afero v1.14.0
 	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
+	github.com/spf13/pflag v1.0.7
 	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.11.1
 	github.com/stuart-warren/yamlfmt v0.2.0
@@ -63,6 +63,7 @@ require (
 replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20250703195040-6f40a3734728
 
 require (
+	github.com/cucumber/godog v0.15.1
 	github.com/go-openapi/runtime v0.28.0
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
 	golang.org/x/text v0.29.0
@@ -169,6 +170,8 @@ require (
 	github.com/coreos/go-oidc/v3 v3.11.0 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/cucumber/gherkin/go/v26 v26.2.0 // indirect
+	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -215,6 +218,7 @@ require (
 	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
+	github.com/gofrs/uuid v4.3.1+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
@@ -236,10 +240,13 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-getter v1.8.1 // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-memdb v1.3.4 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
 	github.com/hashicorp/hcl/v2 v2.23.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
diff --git a/go.sum b/go.sum
index 317c5cfdc..1b4c87684 100644
--- a/go.sum
+++ b/go.sum
@@ -379,12 +379,20 @@ github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GK
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/cucumber/gherkin/go/v26 v26.2.0 h1:EgIjePLWiPeslwIWmNQ3XHcypPsWAHoMCz/YEBKP4GI=
+github.com/cucumber/gherkin/go/v26 v26.2.0/go.mod h1:t2GAPnB8maCT4lkHL99BDCVNzCh1d7dBhCLt150Nr/0=
+github.com/cucumber/godog v0.15.1 h1:rb/6oHDdvVZKS66hrhpjFQFHjthFSrQBCOI1LwshNTI=
+github.com/cucumber/godog v0.15.1/go.mod h1:qju+SQDewOljHuq9NSM66s0xEhogx0q30flfxL4WUk8=
+github.com/cucumber/messages/go/v21 v21.0.1 h1:wzA0LxwjlWQYZd32VTlAVDTkW6inOFmSM+RuOwHZiMI=
+github.com/cucumber/messages/go/v21 v21.0.1/go.mod h1:zheH/2HS9JLVFukdrsPWoPdmUtmYQAQPLk7w5vWsk5s=
+github.com/cucumber/messages/go/v22 v22.0.0/go.mod h1:aZipXTKc0JnjCsXrJnuZpWhtay93k7Rn3Dee7iyPJjs=
 github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f h1:eHnXnuK47UlSTOQexbzxAZfekVz6i+LKRdj1CU5DPaM=
 github.com/cyberphone/json-canonicalization v0.0.0-20231217050601-ba74d44ecf5f/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
@@ -566,6 +574,9 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godoctor/godoctor v0.0.0-20181123222458-69df17f3a6f6/go.mod h1:+tyhT8jBF8E0XvdlSXOSL7Iko7DlNiongHq3q+wcsPs=
+github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.3.1+incompatible h1:0/KbAdpx3UXAx1kEOWHJeOkpbgRFGHVgv+CFIY7dBJI=
+github.com/gofrs/uuid v4.3.1+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
@@ -714,6 +725,11 @@ github.com/hashicorp/go-getter v1.8.1/go.mod h1:2mndIb0CxmdA4Vdc9KcsaAQ/NpADl76u
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
+github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-memdb v1.3.4 h1:XSL3NR682X/cVk2IeV0d70N4DZ9ljI885xAEU8IoK3c=
+github.com/hashicorp/go-memdb v1.3.4/go.mod h1:uBTr1oQbtuMgd1SSGoR8YV27eT3sBHbYiNm53bMpgSg=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
@@ -735,11 +751,14 @@ github.com/hashicorp/go-sockaddr v1.0.5/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3ly
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
 github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
@@ -810,6 +829,7 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxv
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -1129,14 +1149,16 @@ github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.2.1/go.mod h1:ExllRjgxM/piMAM+3tAZvg8fsklGAf3tPfi+i8t68Nk=
+github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
 github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
diff --git a/internal/validate/vsa/service.go b/internal/validate/vsa/service.go
index 81c65171c..f45d98a95 100644
--- a/internal/validate/vsa/service.go
+++ b/internal/validate/vsa/service.go
@@ -39,15 +39,17 @@ type Service struct {
 	fs           afero.Fs
 	policySource string
 	policy       PublicKeyProvider
+	outputDir    string
 }
 
 // NewServiceWithFS creates a new VSA service with the given signer and filesystem
-func NewServiceWithFS(signer *Signer, fs afero.Fs, policySource string, policy PublicKeyProvider) *Service {
+func NewServiceWithFS(signer *Signer, fs afero.Fs, policySource string, policy PublicKeyProvider, outputDir string) *Service {
 	return &Service{
 		signer:       signer,
 		fs:           fs,
 		policySource: policySource,
 		policy:       policy,
+		outputDir:    outputDir,
 	}
 }
 
@@ -56,7 +58,7 @@ func (s *Service) ProcessComponentVSA(ctx context.Context, report applicationsna
 	generator := NewGenerator(report, comp, s.policySource, s.policy)
 	writer := &Writer{
 		FS:            s.fs,
-		TempDirPrefix: "vsa-",
+		TempDirPrefix: s.outputDir,
 		FilePerm:      0o600,
 	}
 
diff --git a/internal/validate/vsa/service_test.go b/internal/validate/vsa/service_test.go
index eee7dace2..5d6a1e245 100644
--- a/internal/validate/vsa/service_test.go
+++ b/internal/validate/vsa/service_test.go
@@ -107,7 +107,7 @@ func TestNewServiceWithFS(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			service := NewServiceWithFS(tt.signer, tt.fs, "https://github.com/test/policy", nil)
+			service := NewServiceWithFS(tt.signer, tt.fs, "https://github.com/test/policy", nil, "vsa-")
 
 			if tt.expectNonNil {
 				assert.NotNil(t, service, "NewServiceWithFS should return non-nil service")
@@ -164,7 +164,7 @@ func TestService_ProcessComponentVSA(t *testing.T) {
 
 	// Create test signer
 	signer := testSigner("/test.key", fs)
-	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil)
+	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil, "vsa-")
 
 	// Test successful processing
 	envelopePath, err := service.ProcessComponentVSA(ctx, report, comp, "https://github.com/test/repo", "sha256:testdigest")
@@ -195,7 +195,7 @@ func TestService_ProcessSnapshotVSA(t *testing.T) {
 
 	// Create test signer
 	signer := testSigner("/test.key", fs)
-	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil)
+	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil, "vsa-")
 
 	// Test successful processing
 	envelopePath, err := service.ProcessSnapshotVSA(ctx, report)
@@ -233,7 +233,7 @@ func TestService_ProcessAllVSAs(t *testing.T) {
 
 	// Create test signer
 	signer := testSigner("/test.key", fs)
-	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil)
+	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil, "vsa-")
 
 	// Define helper functions
 	getGitURL := func(comp applicationsnapshot.Component) string {
@@ -292,7 +292,7 @@ func TestService_ProcessAllVSAs_WithErrors(t *testing.T) {
 
 	// Create test signer
 	signer := testSigner("/test.key", fs)
-	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil)
+	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil, "vsa-")
 
 	// Define helper functions that return errors
 	getGitURL := func(comp applicationsnapshot.Component) string {
@@ -348,7 +348,7 @@ func TestService_ProcessAllVSAs_PartialSuccess(t *testing.T) {
 
 	// Create test signer
 	signer := testSigner("/test.key", fs)
-	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil)
+	service := NewServiceWithFS(signer, fs, "https://github.com/test/policy", nil, "vsa-")
 
 	// Define helper functions - fail for specific component
 	getGitURL := func(comp applicationsnapshot.Component) string {
diff --git a/internal/validate/vsa/vsa.go b/internal/validate/vsa/vsa.go
index 651e58a34..cee6a591b 100644
--- a/internal/validate/vsa/vsa.go
+++ b/internal/validate/vsa/vsa.go
@@ -348,10 +348,22 @@ func (w *Writer) WritePredicate(predicate *Predicate) (string, error) {
 		return "", fmt.Errorf("failed to marshal VSA predicate: %w", err)
 	}
 
-	// Create temp directory
-	tempDir, err := afero.TempDir(w.FS, "", w.TempDirPrefix)
-	if err != nil {
-		return "", fmt.Errorf("failed to create temp directory: %w", err)
+	// Create or use directory based on whether TempDirPrefix is an absolute path
+	var tempDir string
+	if filepath.IsAbs(w.TempDirPrefix) {
+		// TempDirPrefix is an absolute path - use it directly
+		tempDir = w.TempDirPrefix
+		// Ensure the directory exists
+		if err := w.FS.MkdirAll(tempDir, 0o755); err != nil {
+			return "", fmt.Errorf("failed to create output directory: %w", err)
+		}
+	} else {
+		// TempDirPrefix is a prefix - create temp directory
+		var err error
+		tempDir, err = afero.TempDir(w.FS, "", w.TempDirPrefix)
+		if err != nil {
+			return "", fmt.Errorf("failed to create temp directory: %w", err)
+		}
 	}
 
 	// Write to file with same naming convention as old VSA
diff --git a/internal/validate/vsa/vsa_test.go b/internal/validate/vsa/vsa_test.go
index 1ac7af9a6..e6514eb6f 100644
--- a/internal/validate/vsa/vsa_test.go
+++ b/internal/validate/vsa/vsa_test.go
@@ -221,6 +221,65 @@ func TestWritePredicate(t *testing.T) {
 	assert.Equal(t, pred.Summary, output.Summary)
 }
 
+// TestWritePredicate_AbsolutePath tests WritePredicate with absolute path handling
+func TestWritePredicate_AbsolutePath(t *testing.T) {
+	// Set up test filesystem
+	fs := afero.NewMemMapFs()
+
+	// Create test predicate
+	pred := &Predicate{
+		Policy: ecapi.EnterpriseContractPolicySpec{
+			Name: "test-policy",
+		},
+		ImageRefs: []string{"test-image:tag"},
+		Timestamp: "2024-03-21T12:00:00Z",
+		Status:    "passed",
+		Verifier:  "conforma",
+		Summary: VSASummary{
+			Component: ComponentSummary{
+				Name:           "test-component",
+				ContainerImage: "test-image:tag",
+				Source:         nil,
+			},
+		},
+	}
+
+	// Test with absolute path
+	writer := Writer{
+		FS:            fs,
+		TempDirPrefix: "/tmp/test-vsa",
+		FilePerm:      0o600,
+	}
+
+	// Write VSA
+	vsaPath, err := writer.WritePredicate(pred)
+	require.NoError(t, err)
+
+	// Verify the directory was created and file is in the correct location
+	assert.Contains(t, vsaPath, "/tmp/test-vsa/vsa-test-component.json")
+
+	// Verify the directory exists
+	exists, err := afero.DirExists(fs, "/tmp/test-vsa")
+	assert.NoError(t, err)
+	assert.True(t, exists, "Output directory should be created")
+
+	// Read and verify contents
+	data, err := afero.ReadFile(fs, vsaPath)
+	require.NoError(t, err)
+
+	var output Predicate
+	err = json.Unmarshal(data, &output)
+	require.NoError(t, err)
+
+	// Verify fields
+	assert.Equal(t, pred.Policy, output.Policy)
+	assert.Equal(t, pred.ImageRefs, output.ImageRefs)
+	assert.Equal(t, pred.Timestamp, output.Timestamp)
+	assert.Equal(t, pred.Status, output.Status)
+	assert.Equal(t, pred.Verifier, output.Verifier)
+	assert.Equal(t, pred.Summary, output.Summary)
+}
+
 func TestGeneratePredicate(t *testing.T) {
 	// Create test data
 	report := applicationsnapshot.Report{
diff --git a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
index 61ee1da93..59882420f 100644
--- a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
+++ b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
@@ -192,10 +192,41 @@ spec:
       description: Maximum wait time between retries (e.g., "3s", "10s")
       default: "3s"
 
+    - name: ENABLE_VSA
+      type: string
+      description: Enable VSA generation
+      default: "false"
+
+    - name: ATTESTATION_FORMAT
+      type: string
+      description: "Attestation format: dsse (signed envelope) or predicate (raw JSON)"
+      default: "dsse"
+
+    - name: VSA_SIGNING_KEY
+      type: string
+      description: "Signing key for format=dsse (k8s:// or file:// URL)"
+      default: ""
+
+    - name: VSA_UPLOAD
+      type: string
+      description: VSA upload destination
+      default: "local@/var/workdir/vsa"
+
+    - name: ociStorage
+      type: string
+      description: OCI storage URL for trusted artifacts
+      default: ""
+
   results:
     - name: TEST_OUTPUT
       description: Short summary of the policy evaluation for each image
 
+    - name: VSA_GENERATED
+      description: Whether VSAs were generated (true/false)
+
+    - name: sourceDataArtifact
+      description: Trusted Artifact URI containing VSA files
+
   stepTemplate:
     volumeMounts:
       - mountPath: /var/workdir
@@ -260,48 +291,56 @@ spec:
     - name: validate
       image: quay.io/conforma/cli:latest
       onError: continue # progress even if the step fails so we can see the debug logs
-      command: [ec]
-      args:
-        - validate
-        - image
-        - "--images"
-        - "/tekton/home/snapshot.json"
-        - "--policy"
-        - "$(params.POLICY_CONFIGURATION)"
-        - "--public-key"
-        - "$(params.PUBLIC_KEY)"
-        - "--rekor-url"
-        - "$(params.REKOR_HOST)"
-        - "--ignore-rekor=$(params.IGNORE_REKOR)"
-        - "--workers"
-        - "$(params.WORKERS)"
-        # NOTE: The syntax below is required to negate boolean parameters
-        - "--info=$(params.INFO)"
-        # Fresh versions of ec support "--timeout=0" to indicate no timeout, but this would break
-        # the task if it's used with an older version of ec. In an abundance of caution, let's set
-        # an arbitrary high value instead of using 0 here. In future we can change it to 0.
-        # (The reason to not use an explicit timeout for ec is so Tekton can handle the timeouts).
-        - "--timeout=100h"
-        - "--strict=false"
-        - "--show-successes"
-        - "--effective-time=$(params.EFFECTIVE_TIME)"
-        - "--extra-rule-data=$(params.EXTRA_RULE_DATA)"
-        - "--retry-max-wait"
-        - "$(params.RETRY_MAX_WAIT)"
-        - "--retry-max-retry"
-        - "$(params.RETRY_MAX_RETRY)"
-        - "--retry-duration"
-        - "$(params.RETRY_DURATION)"
-        - "--retry-factor"
-        - "$(params.RETRY_FACTOR)"
-        - "--retry-jitter"
-        - "$(params.RETRY_JITTER)"
-        - "--output"
-        - "text=$(params.HOMEDIR)/text-report.txt?show-successes=false"
-        - "--output"
-        - "appstudio=$(results.TEST_OUTPUT.path)"
-        - "--output"
-        - "json=$(params.HOMEDIR)/report-json.json"
+      script: |
+        #!/bin/bash
+        set -euo pipefail
+
+        # Build EC arguments
+        EC_ARGS=(
+          validate
+          image
+          --images /tekton/home/snapshot.json
+          --policy "$(params.POLICY_CONFIGURATION)"
+          --public-key "$(params.PUBLIC_KEY)"
+          --rekor-url "$(params.REKOR_HOST)"
+          --ignore-rekor=$(params.IGNORE_REKOR)
+          --workers "$(params.WORKERS)"
+          --info=$(params.INFO)
+          --timeout=100h
+          --strict=false
+          --show-successes
+          --effective-time=$(params.EFFECTIVE_TIME)
+          --extra-rule-data=$(params.EXTRA_RULE_DATA)
+          --retry-max-wait "$(params.RETRY_MAX_WAIT)"
+          --retry-max-retry "$(params.RETRY_MAX_RETRY)"
+          --retry-duration "$(params.RETRY_DURATION)"
+          --retry-factor "$(params.RETRY_FACTOR)"
+          --retry-jitter "$(params.RETRY_JITTER)"
+          --output "text=$(params.HOMEDIR)/text-report.txt?show-successes=false"
+          --output "appstudio=$(results.TEST_OUTPUT.path)"
+          --output "json=$(params.HOMEDIR)/report-json.json"
+        )
+
+        # Add VSA arguments if enabled
+        if [[ "$(params.ENABLE_VSA)" == "true" ]]; then
+          EC_ARGS+=(--vsa --attestation-format=$(params.ATTESTATION_FORMAT))
+
+          if [[ "$(params.ATTESTATION_FORMAT)" == "dsse" ]]; then
+            if [[ -z "$(params.VSA_SIGNING_KEY)" ]]; then
+              echo "ERROR: VSA_SIGNING_KEY required for format=dsse"
+              exit 1
+            fi
+            EC_ARGS+=(--vsa-signing-key "$(params.VSA_SIGNING_KEY)")
+          fi
+
+          EC_ARGS+=(--vsa-upload "$(params.VSA_UPLOAD)")
+          echo "true" > $(results.VSA_GENERATED.path)
+        else
+          echo "false" > $(results.VSA_GENERATED.path)
+        fi
+
+        # Execute EC with constructed arguments
+        ec "${EC_ARGS[@]}"
       env:
         - name: SSL_CERT_DIR
           # The Tekton Operator automatically sets the SSL_CERT_DIR env to the value below but,
@@ -382,6 +421,35 @@ spec:
           .result == "SUCCESS" or .result == "WARNING" or ($strict | not)
         - "$(results.TEST_OUTPUT.path)"
 
+    - name: create-trusted-artifact
+      when:
+        - input: "$(params.ENABLE_VSA)"
+          operator: in
+          values: ["true"]
+        - input: "$(params.ociStorage)"
+          operator: notin
+          values: ["", "empty"]
+      computeResources:
+        limits:
+          memory: 128Mi
+        requests:
+          memory: 128Mi
+          cpu: 250m
+      ref:
+        resolver: "git"
+        params:
+          - name: url
+            value: "https://github.com/konflux-ci/release-service-catalog"
+          - name: revision
+            value: "development"
+          - name: pathInRepo
+            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
+      params:
+        - name: ociStorage
+          value: $(params.ociStorage)
+        - name: workDir
+          value: /var/workdir
+
   volumes:
     - name: trusted-ca
       configMap: