diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index 73f1449..086d3dc 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -120,8 +120,6 @@ jobs:
         run: |
           mkdir -p dist
           flatpak build-bundle repo "dist/crafter-build-${{ steps.meta.outputs.version }}.flatpak" "$APP_ID" "${{ steps.meta.outputs.branch }}"
-          cp packaging/flatpak/net.catcrafts.CrafterBuild.flatpakref dist/
-          (cd dist && sha256sum * > SHA256SUMS)
           ls -la dist
 
       - name: Upload bundle
@@ -160,6 +158,12 @@ jobs:
           key=$(gpg --export "$FLATPAK_GPG_KEY_ID" | base64 --wrap=0)
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/catcrafts.flatpakrepo > "$WEB_DIR/catcrafts.flatpakrepo"
           sed "s|GPGKey=.*|GPGKey=$key|" packaging/flatpak/net.catcrafts.CrafterBuild.flatpakref > "$WEB_DIR/net.catcrafts.CrafterBuild.flatpakref"
+          # The release attaches this .flatpakref, not the one in the
+          # checkout: that one has a placeholder where the key goes, and
+          # flatpak cannot install from it.
+          cp "$WEB_DIR/net.catcrafts.CrafterBuild.flatpakref" dist/
+          (cd dist && sha256sum * > SHA256SUMS)
+          ls -la dist
 
       - name: Rolling 'latest' release
         if: github.event_name != 'pull_request' && github.ref_type != 'tag'