diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4fe7d52..05bee19 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: write
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -27,19 +30,19 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-latest      # linux/amd64
             goos: linux
             goarch: amd64
-          - os: ubuntu-latest
+          - os: ubuntu-24.04-arm   # linux/arm64 — native arm64 runner
             goos: linux
             goarch: arm64
-          - os: macos-latest
+          - os: macos-13           # darwin/amd64 — native Intel runner
             goos: darwin
             goarch: amd64
-          - os: macos-latest
+          - os: macos-latest       # darwin/arm64 — native Apple Silicon
             goos: darwin
             goarch: arm64
-          - os: windows-latest
+          - os: windows-latest     # windows/amd64
             goos: windows
             goarch: amd64
     steps:
@@ -53,9 +56,11 @@ jobs:
 
       - name: Compute version
         id: version
+        shell: bash
         run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
       - name: Build binary
+        shell: bash
         env:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
diff --git a/install.sh b/install.sh
index c2b1f6b..8f702a8 100755
--- a/install.sh
+++ b/install.sh
@@ -27,8 +27,9 @@ if [ -z "$VERSION" ]; then
   exit 1
 fi
 
-ASSET="enola-${VERSION}-${OS}-${ARCH}.tar.gz"
-SHASUM="${ASSET}.sha256"
+BASE="enola-${VERSION}-${OS}-${ARCH}"
+ASSET="${BASE}.tar.gz"
+SHASUM="${BASE}.sha256"
 URL="https://github.com/enola-labs/enola/releases/download/v${VERSION}/${ASSET}"
 SUM_URL="https://github.com/enola-labs/enola/releases/download/v${VERSION}/${SHASUM}"
 
@@ -41,13 +42,17 @@ curl -fsSL -o "$TMPDIR/$ASSET" "$URL"
 curl -fsSL -o "$TMPDIR/$SHASUM" "$SUM_URL"
 
 echo "==> Verifying checksum ..."
-(cd "$TMPDIR" && sha256sum -c "$SHASUM")
+if command -v sha256sum >/dev/null 2>&1; then
+  (cd "$TMPDIR" && sha256sum -c "$SHASUM")
+else
+  (cd "$TMPDIR" && shasum -a 256 -c "$SHASUM")
+fi
 
 echo "==> Extracting ..."
 tar xzf "$TMPDIR/$ASSET" -C "$TMPDIR"
 
 # --- Install ---
-BIN_NAME="enola-${VERSION}-${OS}-${ARCH}"
+BIN_NAME="${BASE}"
 if [ "$OS" = "windows" ]; then
   BIN_NAME="${BIN_NAME}.exe"
 fi