diff --git a/scripts/publish-catalog.mjs b/scripts/publish-catalog.mjs
index 665e88f..a6f6117 100644
--- a/scripts/publish-catalog.mjs
+++ b/scripts/publish-catalog.mjs
@@ -217,7 +217,7 @@ export async function inspectArchive(spec, archivePath, zipUtils, sequence) {
   verifyPePlatform(worker.data, spec, spec.id);
   return {
     manifest,
-    archive_url: (spec.artifact.url_template ?? spec.artifact.url).replace("{sequence}", String(sequence)),
+    archive_url: `https://github.com/makekosmos/package-index/releases/download/catalog-${sequence}/${spec.artifact.name}`,
     sha256: hash(bytes),
     size: bytes.length,
   };
diff --git a/scripts/publish-catalog.test.mjs b/scripts/publish-catalog.test.mjs
index a2d5004..d19cf3f 100644
--- a/scripts/publish-catalog.test.mjs
+++ b/scripts/publish-catalog.test.mjs
@@ -155,7 +155,8 @@ test("archive policy rejects traversal, collisions, and extra files", async () =
       { name: "icon.png", data: Buffer.from("icon") },
       { name: "manifest.json", data: JSON.stringify(completeManifest(appSpec)) },
     ]);
-    await assert.doesNotReject(() => inspectArchive(appSpec, app, { readZip }, 8));
+    const inspectedApp = await inspectArchive(appSpec, app, { readZip }, 8);
+    assert.equal(inspectedApp.archive_url, "https://github.com/makekosmos/package-index/releases/download/catalog-8/app.kspkg");
     const extra = path.join(dir, "extra.kspkg");
     await writeArchive(extra, spec, [{ name: "payload.exe", data: peFixture() }]);
     await assert.rejects(() => inspectArchive(spec, extra, { readZip }, 8), /unexpected/);