diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 67e798f..982a87d 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -1,19 +1,38 @@
 name: Deploy Website
 
 on:
+  # Website-only changes (landing page, server) ship as soon as they land.
+  # install.sh is deliberately excluded: it pins a release version, so
+  # deploying it on merge advertises a release that does not exist yet. It
+  # goes out via the workflow_run trigger below instead (WAX-605).
   push:
     branches:
       - main
     paths:
       - 'installer/**'
+      - '!installer/public/install.sh'
+  # A finished Release means the version install.sh pins is now downloadable.
+  workflow_run:
+    workflows: [Release]
+    types: [completed]
   workflow_dispatch:
 
 jobs:
   deploy-website:
     runs-on: ubuntu-latest
+    # Only deploy for a release that actually succeeded. Release also runs on
+    # pull_request (version checks only, no publish), so ignore those.
+    if: >-
+      github.event_name != 'workflow_run' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.event == 'push')
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          # For a release, deploy the installer as of the tagged commit rather
+          # than whatever main has drifted to since.
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
       - name: Setup Wasmer
         uses: wasmerio/setup-wasmer@v3.1
       - name: Publish website
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b13f71e..d17ae26 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -187,6 +187,10 @@ jobs:
         with:
           files: |
             wasixcc-*.tar.gz
-          draft: true
+          # Must NOT be a draft: draft assets 404 for anonymous downloads, and
+          # the installer on wasix.cc pins this exact version (see WAX-605).
+          # Everything gating this job (version consistency, build, crates.io
+          # publish) has already passed by the time we get here.
+          draft: false
           prerelease: false
           generate_release_notes: true
diff --git a/installer/public/install.sh b/installer/public/install.sh
index 6afe7aa..f5af489 100755
--- a/installer/public/install.sh
+++ b/installer/public/install.sh
@@ -102,21 +102,37 @@ download_wasixcc() {
 
     log "Fetching the latest wasixcc executable"
 
+    URL="https://github.com/wasix-org/wasixcc/releases/download/v$VERSION/wasixcc-$TARGET.tar.gz"
+    ARCHIVE="wasixcc-$TARGET.tar.gz"
+
     mkdir -p "$WASIXCC_DIR"
     cd "$WASIXCC_DIR"
+
+    # Download to a file rather than piping into tar. On an HTTP error the body
+    # ("Not Found") would otherwise be fed to tar, which reports the misleading
+    # "Unrecognized archive format" and buries the real cause (WAX-605).
+    rm -f "$ARCHIVE"
     if test -n "$CURL" ; then
         if test -n "$GITHUB_TOKEN" ; then
-            "$CURL" -H "authorization: Bearer $GITHUB_TOKEN" -L "https://github.com/wasix-org/wasixcc/releases/download/v$VERSION/wasixcc-$TARGET.tar.gz" --output - | "$TAR" -xz
+            "$CURL" -fL -H "authorization: Bearer $GITHUB_TOKEN" "$URL" --output "$ARCHIVE" \
+                || fail "Failed to download $URL"
         else
-            "$CURL" -L "https://github.com/wasix-org/wasixcc/releases/download/v$VERSION/wasixcc-$TARGET.tar.gz" --output - | "$TAR" -xz
+            "$CURL" -fL "$URL" --output "$ARCHIVE" \
+                || fail "Failed to download $URL"
         fi
     else
         if test -n "$GITHUB_TOKEN" ; then
-            "$WGET" --header "authorization: Bearer $GITHUB_TOKEN" -q -c "https://github.com/wasix-org/wasixcc/releases/download/v$VERSION/wasixcc-$TARGET.tar.gz" -O - | "$TAR" -xz
+            "$WGET" --header "authorization: Bearer $GITHUB_TOKEN" -q "$URL" -O "$ARCHIVE" \
+                || fail "Failed to download $URL"
         else
-            "$WGET" -q -c "https://github.com/wasix-org/wasixcc/releases/download/v$VERSION/wasixcc-$TARGET.tar.gz" -O - | "$TAR" -xz
+            "$WGET" -q "$URL" -O "$ARCHIVE" \
+                || fail "Failed to download $URL"
         fi
     fi
+
+    "$TAR" -xzf "$ARCHIVE" || fail "Failed to extract $ARCHIVE"
+    rm -f "$ARCHIVE"
+
     cd - > /dev/null 2>&1
 
     if test ! -f "$WASIXCC_EXECUTABLE" ; then