diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 9f65691..6762e5d 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -31,6 +31,7 @@ jobs:
         working-directory: client-next
       - run: npm run build
         working-directory: client-next
+      - run: bash scripts/test-release-checksums.sh
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     needs: regression
@@ -60,7 +61,7 @@ jobs:
           fi
           mkdir -p release-artifacts
           npm pack ./server --ignore-scripts --pack-destination release-artifacts
-          sha256sum release-artifacts/*.tgz > release-artifacts/SHA256SUMS
+          bash scripts/write-release-checksums.sh release-artifacts
           printf '%s\n' 'See CHANGELOG.md and docs/OPENCODE-V2-COMPATIBILITY.md for changes and limitations.' 'The attached archive is the tested server package. npm publication is a separate step; verify the registry before claiming it is published.' > release-artifacts/notes.md
           gh release create "$TAG" release-artifacts/*.tgz release-artifacts/SHA256SUMS --target "$GITHUB_SHA" --title "$TAG" --notes-file release-artifacts/notes.md
       - name: Publish npm when an existing token is configured
diff --git a/scripts/test-release-checksums.sh b/scripts/test-release-checksums.sh
new file mode 100644
index 0000000..69bf4fa
--- /dev/null
+++ b/scripts/test-release-checksums.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+printf 'synthetic package\n' > "$tmp/package.tgz"
+sh "$root/scripts/write-release-checksums.sh" "$tmp"
+(cd "$tmp" && sha256sum -c SHA256SUMS)
diff --git a/scripts/write-release-checksums.sh b/scripts/write-release-checksums.sh
new file mode 100644
index 0000000..6964abb
--- /dev/null
+++ b/scripts/write-release-checksums.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+cd "$1"
+sha256sum -- *.tgz > SHA256SUMS