diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 5748373..ac4d184 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -98,6 +98,9 @@ jobs:
         run: |
           set -euo pipefail
           cd "${GITHUB_WORKSPACE}"
+          echo "pwd=$PWD workspace=$GITHUB_WORKSPACE"
+          ls -l dist/ 2>&1 || true
+          for f in dist/*; do printf 'on disk: %s %s bytes\n' "$f" "$(wc -c < "$f")"; done
           tag="${INPUT_TAG:-$REF}"
           # Only a tag push may create the tag; a re-publish must not move it.
           if [ "$EVENT_NAME" = "push" ]; then export TARGET_COMMITISH="$EVENT_SHA"; fi
diff --git a/scripts/publish-release.sh b/scripts/publish-release.sh
index a7732e3..3368eec 100755
--- a/scripts/publish-release.sh
+++ b/scripts/publish-release.sh
@@ -75,7 +75,15 @@ echo "publish: release id $rid ($tag)"
 # Replace same-named assets so re-runs are clean.
 for f in "$@"; do
   [ -f "$f" ] || { echo "publish: missing asset $f" >&2; exit 1; }
+  # Never publish an empty asset: a 0-byte binary/checksum looks like a
+  # successful release and silently breaks everyone who downloads it.
+  bytes=$(wc -c < "$f")
+  if [ "$bytes" -eq 0 ]; then
+    echo "publish: refusing to upload empty asset $f (0 bytes, cwd=$PWD)" >&2
+    exit 1
+  fi
   asset=$(basename "$f")
+  echo "publish: asset $asset is $bytes bytes on disk"
   api_curl -s -H "Authorization: Bearer $FORGEJO_TOKEN" "$api/releases/$rid/assets" \
     | python3 -c "
 import json,sys