diff --git a/wai/wai-quantum-cli/release/formulae.py b/wai/wai-quantum-cli/release/formulae.py
index e8ebaca7a..46e4f6573 100644
--- a/wai/wai-quantum-cli/release/formulae.py
+++ b/wai/wai-quantum-cli/release/formulae.py
@@ -16,7 +16,13 @@ import urllib.request
 
 version, tag, api, repo, public, out = sys.argv[1:7]
 token = os.environ.get("FORGE_TOKEN", "")
-headers = {"Authorization": f"token {token}"} if token else {}
+# A user agent of our own: the public address refuses the library's default one.
+headers = {"User-Agent": "wai-quantum-release"}
+if token:
+    headers["Authorization"] = f"token {token}"
+# The forge's own address, as the API's: the SHA-256 files are read there, over the
+# private network, not through the public address the formula points users to.
+web = api.rsplit("/api/v1", 1)[0]
 
 
 def get(url):
@@ -33,7 +39,7 @@ def digest(archive):
     if archive not in assets or archive + ".sha256" not in assets:
         print(f"note: {archive} is not attached; left out", file=sys.stderr)
         return None
-    return get(assets[archive + ".sha256"]["browser_download_url"]).decode().split()[0]
+    return get(f"{web}/{repo}/releases/download/{tag}/{archive}.sha256").decode().split()[0]
 
 
 def url(archive):