diff --git a/Dockerfile b/Dockerfile
index 2494889..a4bd9fd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -37,7 +37,9 @@ WORKDIR /tmp
 
 # Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
 # verify the tarball's sha256 against the checksums file. Fails the build on
-# any mismatch (checksums.txt entries: "<sha256>  mcp-grafana_Linux_<arch>.tar.gz").
+# any mismatch. The grep is end-anchored: upstream checksums.txt also lists
+# .sbom.json sidecar entries for the same tarball names, which must stay out
+# of the sha256sum input (only the downloaded tarball is verified).
 RUN set -eux; \
     SHORT="${MCP_GRAFANA_VERSION#v}"; \
     case "$TARGETARCH" in \
@@ -47,7 +49,7 @@ RUN set -eux; \
     esac; \
     curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
     curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o "mcp-grafana_${ASSET}.tar.gz"; \
-    grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
+    grep "mcp-grafana_${ASSET}\.tar\.gz$" checksums.txt | sha256sum -c -; \
     tar -xzf "mcp-grafana_${ASSET}.tar.gz" mcp-grafana; \
     chmod +x mcp-grafana