diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55e0e63..6f2448d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -155,7 +155,7 @@ jobs:
           {
             printf 'plugin=%s\n' "$PLUGIN"
             printf 'version=%s\n' "$VER"
-            printf 'archive_name=%s v%s.plugin\n' "$PLUGIN" "$VER"
+            printf 'archive_name=%s.v%s.plugin\n' "$PLUGIN" "$VER"
           } >> "$GITHUB_OUTPUT"
       - name: Verify tag matches plugin.json, READMEs, and CHANGELOG
         run: python3 scripts/check_release_consistency.py --tag "${{ github.ref_name }}"
diff --git a/tests/test_ci_security_contract.py b/tests/test_ci_security_contract.py
index 70d2fd7..c66fce8 100644
--- a/tests/test_ci_security_contract.py
+++ b/tests/test_ci_security_contract.py
@@ -130,6 +130,11 @@ def test_secret_scan_combines_local_and_full_history_scanners(self) -> None:
         ):
             self.assertIn(token, text)
 
+    def test_release_assets_use_download_stable_filenames(self) -> None:
+        text = (WORKFLOWS / "release.yml").read_text(encoding="utf-8")
+        self.assertIn("printf 'archive_name=%s.v%s.plugin\\n'", text)
+        self.assertNotIn("printf 'archive_name=%s v%s.plugin\\n'", text)
+
     def test_public_workflows_never_select_self_hosted_runners(self) -> None:
         for name, text in self._workflow_texts().items():
             with self.subTest(workflow=name):