diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a872254c..ac399271 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,7 +74,11 @@ jobs:
         run: |
           set -euo pipefail
           go build -o /tmp/ref-stunt ./cmd/stunt
-          BIN="$(find dist -name stunt -path '*darwin_arm64*' | head -1)"
+          # The runner is linux: verify the binary it can execute. `stunt
+          # llm` embeds the same hand-maintained reference in every target,
+          # so a source-vs-artifact skew shows up on any platform; the
+          # remaining targets are pinned by checksums.txt.
+          BIN="$(find dist -name stunt -path '*linux_amd64*' | head -1)"
           test -x "$BIN"
           /tmp/ref-stunt llm > /tmp/ref.txt
           "$BIN" llm > /tmp/dist.txt
@@ -82,7 +86,7 @@ jobs:
             echo "::error::shipped binary does not match this checkout (stunt llm differs) — refusing to trust the release artifacts"
             exit 1
           fi
-          echo "provenance check: shipped darwin_arm64 binary matches this checkout"
+          echo "provenance check: shipped linux_amd64 binary matches this checkout"
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4