diff --git a/Dockerfile b/Dockerfile
index ee58a14..6b1e6ce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -43,9 +43,9 @@ RUN set -eux; \
         *) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
     esac; \
     curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
-    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o mcp.tar.gz; \
+    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o "mcp-grafana_${ASSET}.tar.gz"; \
     grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
-    tar -xzf mcp.tar.gz mcp-grafana; \
+    tar -xzf "mcp-grafana_${ASSET}.tar.gz" mcp-grafana; \
     chmod +x mcp-grafana
 
 # The binary is fully static (no INTERP segment) — scratch is sufficient.