diff --git a/backend/tests/test_rc11_release_package.py b/backend/tests/test_rc11_release_package.py
index fdab4c75..1f48e1f0 100644
--- a/backend/tests/test_rc11_release_package.py
+++ b/backend/tests/test_rc11_release_package.py
@@ -74,6 +74,9 @@ def test_release_package_signature_and_checksums_fail_closed(tmp_path: Path) ->
     package.mkdir()
     evidence = package / "readiness.txt"
     evidence.write_text("passed\n", encoding="utf-8")
+    nested_checksums = package / "backup" / module.CHECKSUMS_NAME
+    nested_checksums.parent.mkdir()
+    nested_checksums.write_text("backup evidence\n", encoding="utf-8")
     identity = "geointel-release"
     namespace = "geointel-release"
     (package / module.SIGNERS_NAME).write_text(
diff --git a/scripts/build_release_package.py b/scripts/build_release_package.py
index fe6e3b30..fac8346a 100644
--- a/scripts/build_release_package.py
+++ b/scripts/build_release_package.py
@@ -114,7 +114,7 @@ def verify_checksums(package_dir: Path) -> None:
     actual_paths = {
         path.relative_to(package_dir).as_posix()
         for path in package_files(package_dir, include_generated=True)
-        if path.name != CHECKSUMS_NAME
+        if path.relative_to(package_dir).as_posix() != CHECKSUMS_NAME
     }
     if expected_paths != actual_paths:
         raise RuntimeError(