diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5df8799..a5adb65 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -97,7 +97,8 @@ jobs:
             echo "$program: $got"
             [ "$got" = "$want" ] || { echo "version mismatch: want $want, got $got" >&2; exit 1; }
           done
-          sha256sum -c dist/SHA256SUMS
+          # SHA256SUMS lists bare file names, so verify from inside dist/.
+          ( cd dist && sha256sum -c SHA256SUMS )
 
       - name: Publish to the release
         env: