diff --git a/.github/workflows/setup-release-tool-smoke.yml b/.github/workflows/setup-release-tool-smoke.yml
new file mode 100644
index 0000000..5603135
--- /dev/null
+++ b/.github/workflows/setup-release-tool-smoke.yml
@@ -0,0 +1,41 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: release-tool setup smoke
+
+on:
+  pull_request:
+    paths:
+      - 'actions/setup-release-tool/**'
+      - 'tests/test_setup_release_tool_action.py'
+      - '.github/workflows/setup-release-tool-smoke.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'actions/setup-release-tool/**'
+      - '.github/workflows/setup-release-tool-smoke.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: '8.3'
+          coverage: none
+      - id: release-tool
+        uses: $/actions/setup-release-tool
+        with:
+          version: '0.1.0'
+      - name: Verify installed PHAR
+        env:
+          RELEASE_TOOL_PATH: ${{ steps.release-tool.outputs.path }}
+        run: php "${RELEASE_TOOL_PATH}" --version | grep -F '0.1.0'
diff --git a/tests/test_setup_release_tool_action.py b/tests/test_setup_release_tool_action.py
index dd0e6c5..ba8f0cd 100644
--- a/tests/test_setup_release_tool_action.py
+++ b/tests/test_setup_release_tool_action.py
@@ -19,6 +19,7 @@ def run_script(
         *,
         fake_download: bool = False,
         checksum_mismatch: bool = False,
+        missing_artifact: bool = False,
     ) -> tuple[subprocess.CompletedProcess[str], str, str]:
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
@@ -47,6 +48,9 @@ def run_script(
                     "    *) shift ;;\n"
                     "  esac\n"
                     "done\n"
+                    "if [[ \"${FAKE_MISSING_ARTIFACT:-0}\" == 1 && \"$url\" == *.phar ]]; then\n"
+                    "  exit 22\n"
+                    "fi\n"
                     "if [[ \"$url\" == *.sha256 ]]; then\n"
                     "  if [[ \"${FAKE_CHECKSUM_MISMATCH:-0}\" == 1 ]]; then\n"
                     "    printf '%064d  release-tool.phar\\n' 0 > \"$output\"\n"
@@ -67,6 +71,8 @@ def run_script(
                 env["PATH"] = str(fake_bin) + os.pathsep + env["PATH"]
                 if checksum_mismatch:
                     env["FAKE_CHECKSUM_MISMATCH"] = "1"
+                if missing_artifact:
+                    env["FAKE_MISSING_ARTIFACT"] = "1"
 
             result = subprocess.run(
                 ["bash", str(SCRIPT)],
@@ -119,6 +125,16 @@ def test_checksum_mismatch_fails_closed(self) -> None:
         self.assertIn("checksum mismatch", result.stdout)
         self.assertEqual("", output)
 
+    def test_missing_artifact_fails_closed(self) -> None:
+        result, output, _ = self.run_script(
+            "1.2.3",
+            fake_download=True,
+            missing_artifact=True,
+        )
+
+        self.assertNotEqual(0, result.returncode)
+        self.assertEqual("", output)
+
     def test_script_downloads_phar_and_published_checksum_from_same_exact_tag(self) -> None:
         content = SCRIPT.read_text(encoding="utf-8")