diff --git a/.github/workflows/burrito-release.yaml b/.github/workflows/burrito-release.yaml
index 5b9cd90..f815e8b 100644
--- a/.github/workflows/burrito-release.yaml
+++ b/.github/workflows/burrito-release.yaml
@@ -56,7 +56,32 @@ jobs:
         name: Build all Burrito targets
         run: MIX_ENV=prod mix release lc
       -
-        name: Upload binaries to the GitHub release
+        # `mix release lc`'s exit code alone doesn't guarantee every target
+        # actually produced a binary - Burrito builds each target
+        # independently, so one target failing partway through wouldn't
+        # necessarily fail the whole `mix release` invocation. Not everyone
+        # installing this uses Homebrew (no tap exists yet anyway - see
+        # #14/CRY-37), so these binaries are the primary install path for
+        # a lot of users; silently shipping a release missing one of them
+        # is worse than failing loudly here.
+        name: Verify the required targets actually built
+        run: |
+          missing=0
+          for target in lc_linux_x86_64 lc_macos_aarch64
+          do
+              if [ ! -f "burrito_out/$target" ]
+              then
+                  printf '::error::missing required release artifact: %s\n' "$target"
+                  missing=1
+              fi
+          done
+          [ "$missing" -eq 0 ]
+      -
+        name: Generate checksums for every built artifact
+        run: sha256sum * > SHA256SUMS
+        working-directory: app/burrito_out
+      -
+        name: Upload binaries and checksums to the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh release upload "${{ inputs.tag_name }}" app/burrito_out/* --clobber
diff --git a/Readme.adoc b/Readme.adoc
index 564a5e5..ac84a31 100644
--- a/Readme.adoc
+++ b/Readme.adoc
@@ -44,10 +44,13 @@ standalone executables with no Erlang/Elixir install required.
 
 [source,sh]
 ----
-$ curl -sLo lc https://github.com/rubyists/linear-cli-ex/releases/latest/download/lc_macos_aarch64
-$ chmod +x lc
-$ sudo mv lc /usr/local/bin/lc
+$ curl -sLO https://github.com/rubyists/linear-cli-ex/releases/latest/download/lc_macos_aarch64
+$ curl -sLo SHA256SUMS https://github.com/rubyists/linear-cli-ex/releases/latest/download/SHA256SUMS
+$ grep -q lc_macos_aarch64 SHA256SUMS && grep lc_macos_aarch64 SHA256SUMS | shasum -a 256 -c - <1>
+$ chmod +x lc_macos_aarch64
+$ sudo mv lc_macos_aarch64 /usr/local/bin/lc
 ----
+<1> Linux: `sha256sum -c -` instead of `shasum -a 256 -c -`.
 
 NOTE: A Homebrew tap is planned but not yet available.