diff --git a/scripts/ci-release.sh b/scripts/ci-release.sh
index 8f3efe6..d82d9b4 100755
--- a/scripts/ci-release.sh
+++ b/scripts/ci-release.sh
@@ -79,10 +79,14 @@ curl -fsSL -X POST \
   -F "attachment=@SHA256SUMS" 2>&1 || err "failed to attach SHA256SUMS"
 
 # Verify assets are actually attached (REQ-097, gate C-21).
+# Use the /releases/{id}/assets endpoint (not /releases/tags/{tag}) because
+# the tag endpoint may have a caching delay showing 0 assets even after
+# successful upload.
+sleep 3
 ASSET_COUNT=$(curl -fsSL \
-  "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${VERSION}" \
+  "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/${RELEASE_ID}/assets" \
   -H "Authorization: token ${GITEA_TOKEN}" \
-  | python3 -c "import json,sys; print(len(json.load(sys.stdin).get('attachments',[])))" 2>/dev/null || echo "0")
+  | python3 -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null || echo "0")
 info "release ${VERSION} has ${ASSET_COUNT} assets"
 if [ "${ASSET_COUNT}" -lt 2 ]; then
   err "assets not attached after upload (REQ-097, C-21) — got ${ASSET_COUNT}"