diff --git a/arcup/arcup b/arcup/arcup
index 3590cd36..ca79cf82 100755
--- a/arcup/arcup
+++ b/arcup/arcup
@@ -664,6 +664,11 @@ verify_checksum_file() {
         error "Checksum file has invalid SHA-256 hash: $checksum_path"
     fi
 
+    # sha256sum and shasum both print lowercase, but the format accepted above allows
+    # either case, so fold to lowercase before comparing — otherwise a valid digest
+    # written in uppercase fails as a mismatch. Same normalization detect_platform uses.
+    expected_checksum="$(printf '%s' "$expected_checksum" | tr '[:upper:]' '[:lower:]')"
+
     if [[ -n "$expected_name" ]]; then
         expected_name="${expected_name#\*}"
         expected_name="${expected_name##*/}"
diff --git a/arcup/test_arcup.sh b/arcup/test_arcup.sh
index 49021191..577a800d 100755
--- a/arcup/test_arcup.sh
+++ b/arcup/test_arcup.sh
@@ -117,6 +117,10 @@ test_checksum_validation() {
     verify_checksum_file "$archive" "$checksum_file" "$archive_name"
     pass "valid checksum file passes"
 
+    printf '%s  %s\n' "$(printf '%s' "$checksum" | tr '[:lower:]' '[:upper:]')" "$archive_name" > "$checksum_file"
+    verify_checksum_file "$archive" "$checksum_file" "$archive_name"
+    pass "uppercase checksum digest passes"
+
     printf '%s  other-asset.tar.gz\n' "$checksum" > "$checksum_file"
     expect_fail "checksum filename mismatch fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name"
 }