diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 1b9ae76..fffcae8 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -85,10 +85,13 @@ jobs:
           Xvfb :99 -screen 0 1024x768x16 &
           sleep 1
           wineboot --init >/dev/null 2>&1 || true
-          # Pin Inno Setup version. Upstream lives on GitHub now; old
-          # https://files.jrsoftware.org/is/6/ layout returns 404.
-          INNO_VERSION="6.7.1"
-          INNO_TAG="is-6_7_1"
+          # Pin Inno Setup version. Must match what innoextract on the
+          # runner image can unpack — innoextract 1.11 (latest in Debian
+          # trixie as of 2026-05) supports Inno Setup up to 6.4.x. Newer
+          # versions (6.5+, 6.7+) fail with "Setup loader checksum mismatch".
+          # When innoextract 1.12+ lands we can bump to 6.7.x.
+          INNO_VERSION="6.4.3"
+          INNO_TAG="is-6_4_3"
           curl -fsSL -o /tmp/innosetup.exe \
             "https://github.com/jrsoftware/issrc/releases/download/${INNO_TAG}/innosetup-${INNO_VERSION}.exe"
           # innoextract unpacks the installer payload to ./app — that's the