diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc60e8db..1312ca37 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -216,7 +216,7 @@ jobs:
 
       - name: Upload archives to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: |
             release-assets/voicebox-server-cuda.tar.gz
diff --git a/backend/services/cuda.py b/backend/services/cuda.py
index bb9eb377..fbcbb173 100644
--- a/backend/services/cuda.py
+++ b/backend/services/cuda.py
@@ -156,16 +156,16 @@ async def _download_and_extract_archive(
     if temp_path.exists():
         temp_path.unlink()
 
-    # Fetch expected checksum
+    # Fetch expected checksum (fail-fast: never extract an unverified archive)
     expected_sha = None
     if sha256_url:
         try:
             sha_resp = await client.get(sha256_url)
-            if sha_resp.status_code == 200:
-                expected_sha = sha_resp.text.strip().split()[0]
-                logger.info(f"{label}: expected SHA-256: {expected_sha[:16]}...")
+            sha_resp.raise_for_status()
+            expected_sha = sha_resp.text.strip().split()[0]
+            logger.info(f"{label}: expected SHA-256: {expected_sha[:16]}...")
         except Exception as e:
-            logger.warning(f"{label}: could not fetch checksum — skipping verification: {e}")
+            raise RuntimeError(f"{label}: failed to fetch checksum from {sha256_url}") from e
 
     # Stream download
     downloaded = 0
diff --git a/justfile b/justfile
index 8134226b..22f1bf60 100644
--- a/justfile
+++ b/justfile
@@ -210,7 +210,8 @@ build-server-cuda: _ensure-venv
     if ($LASTEXITCODE -ne 0) { throw "build_binary.py --cuda failed with exit code $LASTEXITCODE" }; \
     $dest = "$env:APPDATA/com.voicebox.app/backends/cuda"; \
     if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }; \
-    Copy-Item "backend/dist/voicebox-server-cuda" $dest -Recurse -Force; \
+    New-Item -ItemType Directory -Path $dest -Force | Out-Null; \
+    Copy-Item "backend/dist/voicebox-server-cuda/*" $dest -Recurse -Force; \
     Write-Host "Copied CUDA backend to $dest"
 
 # Build everything locally: CPU server + CUDA server + installable Tauri app
diff --git a/scripts/package_cuda.py b/scripts/package_cuda.py
index 45b07836..189f531a 100644
--- a/scripts/package_cuda.py
+++ b/scripts/package_cuda.py
@@ -64,7 +64,7 @@ def is_nvidia_file(rel_path: str) -> bool:
         return False
 
     # Files under nvidia/ subdirectory tree (older torch layout)
-    if rel_lower.startswith("nvidia/") or "nvidia/" in rel_lower.split("/", 1)[-1:]:
+    if rel_lower.startswith("nvidia/") or "/nvidia/" in rel_lower:
         # Only DLLs/shared objects — not .py, .dist-info, etc.
         if rel_lower.endswith((".dll", ".so")):
             return True
@@ -127,13 +127,15 @@ def package(
 
     if not nvidia_files:
         print(
-            "WARNING: No NVIDIA files found! The CUDA libs archive will be empty.",
+            f"ERROR: No NVIDIA files found in {onedir_path}. "
+            "Refusing to create an empty CUDA libs archive.",
             file=sys.stderr,
         )
         print(
             "Make sure you built with --cuda and the NVIDIA packages are present.",
             file=sys.stderr,
         )
+        sys.exit(1)
 
     # Create server core archive
     # Files are stored relative to the archive root (no parent directory prefix)