diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 08b3a7d..1726583 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -338,12 +338,16 @@ jobs:
       - name: Generate and verify CI artifact checksums
         shell: bash
         run: |
+          # `verify-checksums` requires the manifest to be named exactly
+          # SHA256SUMS. Each matrix job owns its own dist/native directory and
+          # uploads under a distinct artifact name, so the plain name is
+          # unambiguous here.
           python scripts/native_release.py checksums \
             --directory dist/native \
-            --output dist/native/SHA256SUMS-${{ matrix.platform }}-${{ matrix.architecture }}
+            --output dist/native/SHA256SUMS
           python scripts/native_release.py verify-checksums \
             --directory dist/native \
-            --manifest dist/native/SHA256SUMS-${{ matrix.platform }}-${{ matrix.architecture }}
+            --manifest dist/native/SHA256SUMS
 
       - name: Upload native installers
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/tests/test_native_release.py b/tests/test_native_release.py
index 8656855..55ca675 100644
--- a/tests/test_native_release.py
+++ b/tests/test_native_release.py
@@ -1744,6 +1744,26 @@ def _swap_then_verify(directory: Path, manifest: Path, **kwargs: object) -> int:
     ) == len(expected)
 
 
+def test_every_workflow_checksum_manifest_uses_the_exact_name() -> None:
+    """`verify_checksums` accepts only a manifest named exactly SHA256SUMS.
+
+    The native installer jobs are skipped on pull requests and run on `main`
+    pushes, so a manifest named anything else fails after merge rather than in
+    review. Check the contract as text instead.
+    """
+
+    checked = 0
+    for workflow in sorted((ROOT / ".github" / "workflows").glob("*.yml")):
+        for line in workflow.read_text(encoding="utf-8").splitlines():
+            if "--output" not in line and "--manifest" not in line:
+                continue
+            value = line.removesuffix("\\").strip().split()[-1]
+            if "SHA256SUMS" in value:
+                assert value.endswith("SHA256SUMS"), f"{workflow.name}: {line.strip()}"
+                checked += 1
+    assert checked >= 2
+
+
 def test_release_workflow_attestation_checks_use_one_exact_identity_flag() -> None:
     """Every workflow attestation check must be a command `gh` can run.