diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2c0eb361..1eff9bd7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -141,9 +141,12 @@ jobs:
 
           dist_dir = Path("dist")
           assets = sorted(
-              path
-              for path in dist_dir.iterdir()
-              if path.is_file() and path.name != "SHA256SUMS"
+              (
+                  *dist_dir.glob("*.whl"),
+                  *dist_dir.glob("*.tar.gz"),
+                  *dist_dir.glob("*.cdx.json"),
+              ),
+              key=lambda path: path.name,
           )
           lines = [
               f"{hashlib.sha256(asset.read_bytes()).hexdigest()}  {asset.name}"
diff --git a/tests/scripts/test_script_health_contract.py b/tests/scripts/test_script_health_contract.py
index 59fd8570..c474dbe6 100644
--- a/tests/scripts/test_script_health_contract.py
+++ b/tests/scripts/test_script_health_contract.py
@@ -287,6 +287,9 @@ def test_release_workflow_separates_privileged_publish_from_audited_build() -> N
     assert "Verify release checksums" in publish_text
     assert "packages-dir: pypi-dist" in publish_text
     assert "cyclonedx-json" in publish_text
+    assert 'dist_dir.glob("*.whl")' in publish_text
+    assert 'dist_dir.glob("*.tar.gz")' in publish_text
+    assert 'dist_dir.glob("*.cdx.json")' in publish_text
 
 
 def test_dependency_review_runs_for_dependency_manifest_changes() -> None: