diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8d320964..99771463 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -447,7 +447,16 @@ jobs:
               sys.exit(0)
 
           remote = {u["filename"]: (u.get("digests") or {}).get("sha256") for u in payload.get("urls") or []}
-          local = sorted(p for p in pathlib.Path("dist").iterdir() if p.is_file())
+          # gh-action-pypi-publish v1.14+ writes `<dist>.publish.attestation`
+          # sidecars into packages-dir before upload. PyPI serves attestations
+          # via the integrity API, never as distribution files, so the sidecars
+          # must not enter the set-equality comparison below -- with them, this
+          # assert fails on every release even when the publish is complete and
+          # attested (observed on the v0.10.1 run).
+          local = sorted(
+              p for p in pathlib.Path("dist").iterdir()
+              if p.is_file() and not p.name.endswith(".publish.attestation")
+          )
           if not local:
               print("::error::no files in dist/ to compare -- the download-artifact step produced nothing")
               sys.exit(1)