diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27caeeb..53ecb32 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,8 +54,17 @@ jobs:
           export PATH="$PWD/bin:$PATH"
           make precommit
 
+      # Pin to Makefile SFETCH_VERSION (N-1 fully-signed release), never latest.
+      # Main CI after a release tag races incomplete asset uploads if dry-run
+      # follows latest (404 on platform archives still mid-matrix upload).
+      # Use `make print-sfetch-version` so make expands the pin (any semver shape).
       - name: Test install script
-        run: bash scripts/install-sfetch.sh --dry-run
+        run: |
+          set -euo pipefail
+          TAG=$(make -s print-sfetch-version)
+          test -n "$TAG"
+          echo "Install smoke pin: $TAG (make print-sfetch-version)"
+          bash scripts/install-sfetch.sh --dry-run --tag "$TAG" --require-minisign
 
   container-probe:
     name: Install probe (container)
diff --git a/Makefile b/Makefile
index 5aac9fb..f6cb595 100644
--- a/Makefile
+++ b/Makefile
@@ -41,6 +41,10 @@ SCOOP_BUCKET_REPO ?= https://github.com/3leaps/scoop-bucket.git
 BIN_DIR := $(CURDIR)/bin
 
 # Pinned tool versions (every gate/release tool is version-pinned; no @latest)
+# SFETCH_VERSION is the N-1 self-bootstrap pin AND the CI install-script smoke
+# pin (see .github/workflows/ci.yml). Always a fully-signed published release —
+# never "latest" and never the in-flight cut — so main CI cannot 404 during the
+# tag/upload window. Advance after each release publishes + signs.
 SFETCH_VERSION := v0.4.8
 GONEAT_VERSION ?= v0.5.15
 GOVULNCHECK_VERSION ?= v1.6.0
@@ -57,9 +61,16 @@ CORPUS_DEST ?= test-corpus
 .PHONY: release-verify-key release-verify-minisign-pubkey release-verify-keys release-verify-signatures
 .PHONY: release-clean bootstrap-script build-all gosec gosec-high update-scoop-manifest
 .PHONY: version-check version-set version-patch version-minor version-major
+.PHONY: print-sfetch-version
 
 all: build
 
+# Echo SFETCH_VERSION via make (not shell parsing of Makefile). CI install smoke
+# and other tools should use this so patch/minor/major pin values always expand
+# correctly regardless of assignment form or version shape.
+print-sfetch-version: ## Print bootstrap/CI smoke pin (SFETCH_VERSION)
+	@echo $(SFETCH_VERSION)
+
 help: ## Show this help
 	@echo "sfetch - secure, verifying binary fetcher for GitHub releases"
 	@echo ""