diff --git a/.github/workflows/rock-pull-request.yaml b/.github/workflows/rock-pull-request.yaml
index 6625e8de..96357bdb 100644
--- a/.github/workflows/rock-pull-request.yaml
+++ b/.github/workflows/rock-pull-request.yaml
@@ -63,10 +63,18 @@ jobs:
           sudo concierge prepare -p microk8s --extra-snaps rockcraft,just,kubectl
           sudo microk8s enable registry
           # FIXME: install via the goss snap when available
-          goss_base_url="https://github.com/goss-org/goss/releases/latest/download"
-          curl -L ${goss_base_url}/goss-linux-$(dpkg --print-architecture) -o /usr/local/bin/goss
+          # goss >= v0.4.10 ships per-arch tarballs instead of raw
+          # goss-linux-<arch> binaries, so pin a version and extract the tarball.
+          goss_version="v0.4.10"
+          goss_base_url="https://github.com/goss-org/goss/releases/download/${goss_version}"
+          case "$(dpkg --print-architecture)" in
+            amd64) goss_arch="x86_64" ;;
+            arm64) goss_arch="arm64" ;;
+            *) echo "unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;;
+          esac
+          curl -sSfL "${goss_base_url}/goss_${goss_version#v}_linux_${goss_arch}.tar.gz" | tar -xz -C /usr/local/bin goss
           chmod +rx /usr/local/bin/goss
-          curl -L ${goss_base_url}/kgoss -o /usr/local/bin/kgoss
+          curl -sSfL "${goss_base_url}/kgoss" -o /usr/local/bin/kgoss
           chmod +rx /usr/local/bin/kgoss
       - name: Print disk utilization
         if: ${{ (runner.debug == '1') }}