diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
index ef7ae24..b9f075a 100644
--- a/.github/workflows/verify-release.yml
+++ b/.github/workflows/verify-release.yml
@@ -59,9 +59,13 @@ jobs:
           import json, os
           from pathlib import Path
           identities = []
-          for path in Path("distribution-identities").glob("*/release-identity.json"):
+          for path in Path("distribution-identities").rglob("release-identity.json"):
               item = json.loads(path.read_text(encoding="utf-8"))
-              assert path.parent.name == 'distributed-release-' + item['run_attempt'], "Artifact attempt mismatch"
+              # download-artifact@v8 extracts the only matched artifact directly
+              # into the path, with no artifact-name directory; several matches
+              # each get one, so the attempt is name-checked only in that layout.
+              if path.parent.name.startswith('distributed-release-'):
+                  assert path.parent.name == 'distributed-release-' + item['run_attempt'], "Artifact attempt mismatch"
               identities.append(item)
           assert identities, "No distributed release identity found"
           assert all(item["run_id"] == os.environ["DISTRIBUTION_RUN_ID"] for item in identities), "Distribution run mismatch"
diff --git a/tests/test_release_workflows.py b/tests/test_release_workflows.py
index 8d445c4..44352fa 100644
--- a/tests/test_release_workflows.py
+++ b/tests/test_release_workflows.py
@@ -135,6 +135,35 @@ def test_distributed_version_survives_a_newer_pypi_release(tmp_path: Path) -> No
     )
 
 
+@pytest.mark.skipif(os.name != "posix" or shutil.which("bash") is None, reason="Executes an Ubuntu Bash workflow")
+def test_distributed_version_reads_the_flat_single_artifact_layout(tmp_path: Path) -> None:
+    producer = _step("distribute.yml", "resolve", "Record distributed release")
+    consumer = _step("verify-release.yml", "verify", "Resolve target version")
+    env = {
+        **os.environ,
+        "VERSION": "0.37.0",
+        "GITHUB_RUN_ID": "123",
+        "GITHUB_RUN_ATTEMPT": "2",
+        "GITHUB_OUTPUT": str(tmp_path / "output"),
+        "EVENT_NAME": "workflow_run",
+        "INPUT_VERSION": "",
+        "DISTRIBUTION_RUN_ID": "123",
+        "DISTRIBUTION_RUN_ATTEMPT": "2",
+    }
+    subprocess.run(["bash", "-eu", "-c", producer["run"]], cwd=tmp_path, env=env, check=True)
+    # download-artifact@v8 extracts the only pattern-matched artifact directly
+    # into the target path, with no artifact-name directory.
+    artifact = tmp_path / "distribution-identities"
+    artifact.mkdir()
+    (artifact / "release-identity.json").write_bytes((tmp_path / "release-identity.json").read_bytes())
+
+    result = subprocess.run(
+        ["bash", "-eu", "-c", consumer["run"]], cwd=tmp_path, env=env, capture_output=True, text=True
+    )
+    assert result.returncode == 0, result.stderr
+    assert "version=0.37.0" in (tmp_path / "output").read_text()
+
+
 @pytest.mark.skipif(os.name != "posix" or shutil.which("bash") is None, reason="Executes an Ubuntu Bash workflow")
 def test_clawhub_uses_local_install(tmp_path: Path) -> None:
     script = _step("distribute.yml", "clawhub", "Publish the agent skill when its version moved")["run"]