diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml
index fc7252ac52..d97ec5aa29 100644
--- a/.github/workflows/release-beta.yml
+++ b/.github/workflows/release-beta.yml
@@ -314,7 +314,10 @@ jobs:
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: beta-${{ matrix.name }}
-          path: tracedecay-beta-*
+          # The exact archive, not `tracedecay-beta-*`: that glob also matched
+          # the MCPB packaged beside it, so publish found MCPBs among the
+          # binaries and refused the whole release (beta.43).
+          path: tracedecay-beta-${{ env.RELEASE_TAG }}-${{ matrix.name }}.${{ matrix.archive }}
           if-no-files-found: error
 
   publish:
diff --git a/scripts/test-check-release-artifacts.py b/scripts/test-check-release-artifacts.py
index 56ed40aff1..c0efe9c74e 100644
--- a/scripts/test-check-release-artifacts.py
+++ b/scripts/test-check-release-artifacts.py
@@ -117,6 +117,21 @@ def main() -> int:
         (root / "binaries" / "tracedecay-beta-v1.2.3-windows.zip").unlink()
         (root / "mcpbs" / "tracedecay-beta-v1.2.3-windows.mcpb").unlink()
         run(root, False, profile="beta", allow_missing=True)
+        # An MCPB that leaked into the binaries directory (a `tracedecay-beta-*`
+        # artifact glob did this) is foreign there, in both modes.
+        for child in ("binaries", "mcpbs"):
+            for item in (root / child).iterdir():
+                item.unlink()
+        for target in manifest["include"]:
+            (root / "binaries" / (
+                f"tracedecay-beta-v1.2.3-{target['name']}.{target['archive']}"
+            )).write_bytes(b"artifact")
+            (root / "mcpbs" / (
+                f"tracedecay-beta-v1.2.3-{target['name']}.mcpb"
+            )).write_bytes(b"artifact")
+        (root / "binaries" / "tracedecay-beta-v1.2.3-linux.mcpb").write_bytes(b"artifact")
+        run(root, False, profile="beta")
+        run(root, False, profile="beta", allow_missing=True)
     print("release artifact validator tests passed")
     return 0