diff --git a/action.yaml b/action.yaml
index c0aeff7..c6384eb 100644
--- a/action.yaml
+++ b/action.yaml
@@ -95,6 +95,7 @@ runs:
       shell: bash
       env:
         CURL_RETRY_ALL_ERRORS: ${{ inputs.retry-all-errors }}
+        ENVIRONMENT: ${{ inputs.environment }}
       run: |
         cd $(mktemp -d)
 
@@ -112,7 +113,7 @@ runs:
           arch="arm64"
         fi
 
-        url="https://dl.${{ inputs.environment }}/chainctl/latest/chainctl_${os}_${arch}"
+        url="https://dl.${ENVIRONMENT}/chainctl/latest/chainctl_${os}_${arch}"
         out="chainctl"
         if [[ "${os}" == "windows" ]]; then
           url="${url}.exe"
@@ -125,6 +126,32 @@ runs:
         else
           curl -o ./${out} -fsL --retry 5 --retry-delay 1 --retry-all-errors "${url}"
         fi
+
+        # Verify chainctl binary checksum
+        checksums_url="https://dl.${ENVIRONMENT}/chainctl/latest/chainctl_checksums.txt"
+        echo "Downloading checksums from ${checksums_url}"
+        curl -o checksums.txt -fsL --retry 3 --retry-delay 1 "${checksums_url}"
+        expected=$(grep "chainctl_${os}_${arch}" checksums.txt | awk '{print $1}')
+        if [[ -z "${expected}" ]]; then
+          echo "::error::No checksum found for chainctl_${os}_${arch} in checksums.txt"
+          exit 1
+        fi
+        if command -v sha256sum &>/dev/null; then
+          actual=$(sha256sum "./${out}" | awk '{print $1}')
+        elif command -v shasum &>/dev/null; then
+          actual=$(shasum -a 256 "./${out}" | awk '{print $1}')
+        elif command -v powershell &>/dev/null; then
+          actual=$(powershell -Command "(Get-FileHash -Algorithm SHA256 './${out}').Hash.ToLower()")
+        else
+          echo "::error::No sha256 tool available (tried sha256sum, shasum, PowerShell Get-FileHash)"
+          exit 1
+        fi
+        if [[ "${expected}" != "${actual}" ]]; then
+          echo "::error::Checksum mismatch for chainctl: expected ${expected}, got ${actual}"
+          exit 1
+        fi
+        echo "Checksum verified for chainctl_${os}_${arch}"
+
         chmod +x ./${out}
         echo "$(pwd)" >> $GITHUB_PATH
 
@@ -211,4 +238,4 @@ runs:
       name: Install Python keyring package
       shell: bash
       run: |
-        python -m pip install "keyrings-chainguard-libraries"
+        python -m pip install "keyrings-chainguard-libraries==0.2.0"
\ No newline at end of file