diff --git a/pattern.sh b/pattern.sh
index b2172fd4..7c48893e 100755
--- a/pattern.sh
+++ b/pattern.sh
@@ -17,6 +17,46 @@ function is_container() {
     return 1
 }
 
+function verify_image() {
+    local image="$1"
+
+    case "${image}" in
+        quay.io/validatedpatterns/*|quay.io/hybridcloudpatterns/*)
+            ;;
+        *)
+            echo "Skipping image verification for third-party registry"
+            return 0
+            ;;
+    esac
+
+    if ! command -v cosign >/dev/null 2>&1; then
+        echo "WARNING: cosign is not installed, cannot verify image signature"
+        echo "Install cosign to enable image verification: https://docs.sigstore.dev/cosign/system_config/installation/"
+        return 0
+    fi
+
+    echo "Verifying image signature for ${image}..."
+    local output rc
+    local oidc_issuer="${VP_COSIGN_OIDC_ISSUER:-https://token.actions.githubusercontent.com}"
+    local cert_identity="${VP_COSIGN_CERT_IDENTITY:-https://github.com/validatedpatterns/utility-container/.*}"
+    output=$(cosign verify \
+        --certificate-oidc-issuer "${oidc_issuer}" \
+        --certificate-identity-regexp "${cert_identity}" \
+        "${image}" 2>&1) && rc=$? || rc=$?
+
+    if [ "${rc}" -eq 0 ]; then
+        echo "Image signature verified successfully"
+    elif [ "${rc}" -ge 10 ] && [ "${rc}" -le 13 ]; then
+        echo "ERROR: Image signature verification failed for ${image} (exit code ${rc})"
+        echo "${output}"
+        echo "Set VP_VERIFY_IMAGE=false to skip this check"
+        exit 1
+    else
+        echo "WARNING: Could not verify image signature for ${image} (likely a network issue)"
+        echo "Set VP_VERIFY_IMAGE=false to skip this check"
+    fi
+}
+
 if is_container; then
     echo "Already running in a container"
     exec "$@"
@@ -103,7 +143,16 @@ fi
 # $HOME is mounted as itself for any files that are referenced with absolute paths
 # $HOME is mounted to /root because the UID in the container is 0 and that's where SSH looks for credentials
 
-podman run -it --rm --pull=newer \
+if [ "${VP_VERIFY_IMAGE:-true}" != "false" ]; then
+    verify_image "$PATTERN_UTILITY_CONTAINER"
+fi
+
+PULL_ARG="--pull=newer"
+if [[ "$PATTERN_UTILITY_CONTAINER" == *@sha256:* ]]; then
+    PULL_ARG=""
+fi
+
+podman run -it --rm ${PULL_ARG} \
     --security-opt label=disable \
     -e ANSIBLE_STDOUT_CALLBACK \
     -e DISABLE_VALIDATE_ORIGIN \