diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 31535d5..3834983 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -44,13 +44,13 @@ archives:
 
 checksum:
   name_template: "checksums.txt"
+  algorithm: sha256
 
 # One SPDX SBOM per released archive (generated with syft, which the
 # release workflow installs). Lands next to the archives on the release
 # page so consumers can audit exactly what each binary contains.
 sboms:
   - artifacts: archive
-  algorithm: sha256
 
 snapshot:
   version_template: "{{ incpatch .Version }}-next"