diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95f48ef..8d882d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,4 +59,3 @@ jobs:
             echo 'Bundled script is out of date, update it with `cd shell-setup; deno task bundle`'.
             exit 1
           fi
-
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6e3c930..9c9faf1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,7 +2,7 @@ name: Publish
 on:
   push:
     tags:
-      - '*'
+      - "*"
 
 jobs:
   publish:
diff --git a/install.sh b/install.sh
index cf0c602..7557ff0 100755
--- a/install.sh
+++ b/install.sh
@@ -41,6 +41,14 @@ if command -v unzip >/dev/null; then
 else
 	7z x -o"$bin_dir" -y "$exe.zip"
 fi
+
+# verify checksum
+if command -v shasum >/dev/null && [ -f "$exe.sha256sum" ]; then
+	shasum -a 256 -c "$exe.sha256sum"
+else
+	echo "Warning: Couldn't verify checksum (sha256sum not found)"
+fi
+
 chmod +x "$exe"
 rm "$exe.zip"