diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ce20ae7..b367bb9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -102,16 +102,27 @@ jobs:
       contents: write
 
     steps:
-      - name: Download all artifacts
+      # Download only distribution artifacts (wheels + sdist) into dist/.
+      # The SBOM is downloaded separately below so it never lands in dist/,
+      # otherwise twine rejects it as `InvalidDistribution` during publish.
+      - name: Download wheel artifacts
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
+          pattern: wheels-*
           path: dist
           merge-multiple: true
 
+      - name: Download sdist artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: sdist
+          path: dist
+
       - name: Download SBOM
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: sbom
+          # No `path:` — lands in the workflow root, not dist/.
 
       - name: Generate SHA256 checksums
         run: |