diff --git a/README.md b/README.md
index 82b46de..fe4aaac 100644
--- a/README.md
+++ b/README.md
@@ -89,13 +89,14 @@ Rationale: [ADR 1](docs/adr/0001-immutable-subject-format-by-default.md),
 
 Pushing a `v*` tag builds binaries for all platforms via
 [gh-extension-precompile](https://github.com/cli/gh-extension-precompile), with GitHub build
-provenance attestations and cosign keyless signatures (`*.sigstore.json`). Verify a download:
+provenance attestations and cosign keyless signatures (`<platform>.sigstore.json`). Verify a
+download, e.g. `gh release download v0.1.3 -R jabbrwcky/gh-sub-pattern -p "darwin-arm64*"`:
 
 ```sh
-gh attestation verify gh-sub-pattern_v1.0.0_darwin-arm64 --repo jabbrwcky/gh-sub-pattern
+gh attestation verify darwin-arm64 --repo jabbrwcky/gh-sub-pattern
 
-cosign verify-blob gh-sub-pattern_v1.0.0_darwin-arm64 \
-  --bundle gh-sub-pattern_v1.0.0_darwin-arm64.sigstore.json \
+cosign verify-blob darwin-arm64 \
+  --bundle darwin-arm64.sigstore.json \
   --certificate-identity-regexp "^https://github.com/jabbrwcky/gh-sub-pattern/" \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
 ```
diff --git a/main.go b/main.go
index cc4ba98..d34f7c1 100644
--- a/main.go
+++ b/main.go
@@ -86,7 +86,11 @@ func run(cli CLI) error {
 		if err != nil {
 			return err
 		}
-		subs = []string{parseChoice(choice)}
+		suffix, err := parseChoice(choice)
+		if err != nil {
+			return err
+		}
+		subs = []string{suffix}
 	}
 	for _, s := range subs {
 		fmt.Fprintln(stdout, "repo:"+repoSegment(info, immutable)+":"+s)
@@ -142,11 +146,14 @@ func refSuffix(ref string) string {
 }
 
 // parseChoice accepts a picked candidate as-is and treats free text as a ref.
-func parseChoice(s string) string {
+func parseChoice(s string) (string, error) {
+	if s == "environment:" || s == "ref:" {
+		return "", fmt.Errorf("%q needs a name after the colon", s)
+	}
 	if strings.HasPrefix(s, "environment:") || strings.HasPrefix(s, "ref:") {
-		return s
+		return s, nil
 	}
-	return refSuffix(s)
+	return refSuffix(s), nil
 }
 
 // candidates lists sub suffixes: environments, pull_request, refs and every parent-path glob.
diff --git a/main_test.go b/main_test.go
index dfe1c37..16d9f0d 100644
--- a/main_test.go
+++ b/main_test.go
@@ -20,8 +20,13 @@ func TestParseChoice(t *testing.T) {
 		"ref:refs/heads/main":   "ref:refs/heads/main",
 		"ref:refs/heads/feat/*": "ref:refs/heads/feat/*",
 	} {
-		if got := parseChoice(in); got != want {
-			t.Errorf("parseChoice(%q) = %q, want %q", in, got, want)
+		if got, err := parseChoice(in); err != nil || got != want {
+			t.Errorf("parseChoice(%q) = %q, %v, want %q", in, got, err, want)
+		}
+	}
+	for _, in := range []string{"environment:", "ref:"} {
+		if _, err := parseChoice(in); err == nil {
+			t.Errorf("parseChoice(%q): expected error", in)
 		}
 	}
 }