diff --git a/internal/attestation/attestation.go b/internal/attestation/attestation.go
index 3e63005df..2247f7e6d 100644
--- a/internal/attestation/attestation.go
+++ b/internal/attestation/attestation.go
@@ -166,6 +166,11 @@ func ProvenanceFromBundlePayload(sig oci.Signature, dsseJSON []byte) (Attestatio
 		return nil, fmt.Errorf("malformed bundle attestation: %w", err)
 	}
 
+	if statement.Type != in_toto.StatementInTotoV1 &&
+		statement.Type != in_toto.StatementInTotoV01 {
+		return nil, fmt.Errorf("unsupported attestation type: %s", statement.Type)
+	}
+
 	signatures, err := createEntitySignatures(sig, payload)
 	if err != nil {
 		return nil, fmt.Errorf("cannot create signed entity: %w", err)
diff --git a/internal/attestation/attestation_test.go b/internal/attestation/attestation_test.go
index f14860482..99b925f1e 100644
--- a/internal/attestation/attestation_test.go
+++ b/internal/attestation/attestation_test.go
@@ -126,6 +126,7 @@ func TestProvenanceFromSignature(t *testing.T) {
 			snaps.MatchJSON(t, string(p.Statement()))
 		})
 	}
+
 }
 
 func TestProvenance_Type(t *testing.T) {
@@ -284,6 +285,27 @@ func TestProvenanceFromBundlePayload(t *testing.T) {
 				base64.StdEncoding.EncodeToString([]byte(`not-json`))),
 			expectErr: "malformed bundle attestation",
 		},
+		{
+			name:  "unsupported attestation type",
+			setup: func(l *mockSignature) {},
+			dsseJSON: fmt.Sprintf(`{"payloadType":"application/vnd.in-toto+json","signatures": [%s], "payload": "%s"}`,
+				sig1, encode(`{
+					"_type": "https://bogus.example.io/Statement/v9.9",
+					"predicateType": "https://cool-type.example.io/Amazing/v2.0",
+					"predicate": {}
+				}`)),
+			expectErr: "unsupported attestation type: https://bogus.example.io/Statement/v9.9",
+		},
+		{
+			name:  "empty attestation type",
+			setup: func(l *mockSignature) {},
+			dsseJSON: fmt.Sprintf(`{"payloadType":"application/vnd.in-toto+json","signatures": [%s], "payload": "%s"}`,
+				sig1, encode(`{
+					"predicateType": "https://cool-type.example.io/Amazing/v2.0",
+					"predicate": {}
+				}`)),
+			expectErr: "unsupported attestation type: ",
+		},
 	}
 
 	for _, c := range cases {