diff --git a/.github/RELEASE_NOTES_TEMPLATE.md b/.github/RELEASE_NOTES_TEMPLATE.md
index 6929e91..1fc71c2 100644
--- a/.github/RELEASE_NOTES_TEMPLATE.md
+++ b/.github/RELEASE_NOTES_TEMPLATE.md
@@ -2,6 +2,7 @@
 
 ### Highlights
 
+- Fixed the release checksum manifest so downloaded assets verify directly with `sha256sum -c sha256sums.txt`.
 - Added reversible one-time External ID migration for existing AWS setups with `external-id --value` and `external-id --clear`.
 - Added AWS GovCloud workflows for both regular Forward Organizations/NQE discovery and reviewed standalone-account manifests.
 - Added `onboard-accounts` and `sync-accounts` for environments where AWS Organizations is unavailable by policy.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 96b74d0..fe7ba82 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,19 +81,10 @@ jobs:
             [ -f "$file" ] || continue
             tar -czf "${file}.tar.gz" -C dist "$(basename "$file")"
           done
-          for file in dist/awssync-*; do
-            [ -f "$file" ] || continue
-            case "$file" in
-              *.tar.gz|*.txt)
-                continue
-                ;;
-            esac
-            sha256sum "$file" >> dist/sha256sums.txt
-          done
-          for file in dist/awssync-*.tar.gz; do
-            [ -f "$file" ] || continue
-            sha256sum "$file" >> dist/sha256sums.txt
-          done
+          (
+            cd dist
+            sha256sum awssync-* > sha256sums.txt
+          )
       - name: Verify artifacts are executable and checksums match
         run: |
           for file in \
@@ -107,7 +98,10 @@ jobs:
               exit 1
             fi
           done
-          sha256sum -c dist/sha256sums.txt
+          (
+            cd dist
+            sha256sum -c sha256sums.txt
+          )
       - name: Generate build provenance
         uses: actions/attest-build-provenance@v4
         with: