diff --git a/scripts/releasing/pull_release_artifacts.sh b/scripts/releasing/pull_release_artifacts.sh
index f28899d..1e872a9 100755
--- a/scripts/releasing/pull_release_artifacts.sh
+++ b/scripts/releasing/pull_release_artifacts.sh
@@ -18,17 +18,19 @@ done
 [ ! -e "gh-release-artifacts/${RELEASE}" ]
 
 mkdir -p "gh-release-artifacts/${RELEASE}"
+
+git archive --format=tar.gz -o "gh-release-artifacts/${RELEASE}/ghcup-${RELEASE}-src.tar.gz" --prefix="ghcup-${RELEASE}/" HEAD
+
 cd "gh-release-artifacts/${RELEASE}"
 
 # github
-gh release download $RELEASE
-
-rm test-*
+gh release download "$RELEASE"
 
 # cirrus
-curl -L -o x86_64-portbld-freebsd-ghcup-${RELEASE} \
+curl -L -o "x86_64-portbld-freebsd-ghcup-${RELEASE}" \
 	"https://api.cirrus-ci.com/v1/artifact/github/haskell/ghcup-hs/build/binaries/out/x86_64-portbld-freebsd-ghcup-${RELEASE}?branch=${RELEASE}"
 
-sha256sum *ghcup* > SHA256SUMS
+sha256sum ./*-ghcup-* > SHA256SUMS
 gpg --detach-sign -u "${SIGNER}" SHA256SUMS
 
+gh release upload "$RELEASE" "ghcup-${RELEASE}-src.tar.gz" "x86_64-portbld-freebsd-ghcup-${RELEASE}" SHA256SUMS SHA256SUMS.sig