Although legitimacy theory provides strong arguments that environmental, social and governance (ESG) disclosure and performance can help mitigate firm-specific (idiosyncratic) risks, this relationship has been repeatedly challenged by conceptual arguments, such as ‘transparency fallacy’ or ‘impression management’, and mixed empirical evidence. Therefore, we investigate this relationship in the revelatory case of initial public offerings (IPOs), which represent the first sale of common stock to the wider public. IPOs are characterised by strong information asymmetry between firm insiders and society, while at the same time suffering from uncertainty in firm legitimacy, culminating in amplified financial risks for both issuers and investors in aftermarket trading. Using data from the United States, we demonstrate that (1) voluntary ESG disclosure reduces idiosyncratic volatility and downside tail risk and (2) higher ESG ratings have lower associated firm-specific volatility and downside tail risk during the first year of trading in the aftermarket. We provide theoretical arguments for the relationships observed, suggesting that companies striving for ESG performance and communicating their efforts signal their compliance with sustainability-related norms, thus acquiring and upholding a societal license to operate. ESG performance and disclosure help companies build their reputation capital with investors after going public. We also report that ESG disclosure is a more consistent proxy for ex-ante uncertainty as an indicator of aftermarket risk, thereby replacing some of the more conventional measures, such as firm age, offered in the existing literature.