diff --git a/build/build-jasp.sh b/build/build-jasp.sh
index 97a3fea..6b74d4d 100755
--- a/build/build-jasp.sh
+++ b/build/build-jasp.sh
@@ -579,13 +579,18 @@ ICU_MAJOR="$(echo "$ICU_FULL" | grep -oE '^[0-9]+')"
 BOOST_FULL="$(pkgver_of boost-libs)"
 
 JASP_VER="${JASP_TAG#v}"
-TARBALL="jasp-desktop-${JASP_VER}-x86_64.tar.zst"
-
-log "creating $TARBALL"
+# The name carries a prefix of the content hash. The tarball host serves these
+# as immutable for a year, so a name must never be reused for different bytes:
+# a rebuild of the same JASP version would otherwise let a cache hand out the
+# old tarball against the new PKGBUILD's sha256.
+log "creating tarball"
 cd "$STAGE_DIR"
-tar --zstd -cf "$OUT_DIR/$TARBALL" .
-SHA256="$(sha256sum "$OUT_DIR/$TARBALL" | awk '{print $1}')"
+tar --zstd -cf "$OUT_DIR/jasp-desktop.tar.zst.tmp" .
+SHA256="$(sha256sum "$OUT_DIR/jasp-desktop.tar.zst.tmp" | awk '{print $1}')"
+TARBALL="jasp-desktop-${JASP_VER}-${SHA256:0:12}-x86_64.tar.zst"
+mv "$OUT_DIR/jasp-desktop.tar.zst.tmp" "$OUT_DIR/$TARBALL"
 SIZE="$(stat -c%s "$OUT_DIR/$TARBALL")"
+log "created $TARBALL"
 
 cat >"$OUT_DIR/build-info.json" <<EOF
 {
diff --git a/packaging/PKGBUILD.in b/packaging/PKGBUILD.in
index 5569f32..9b596c8 100644
--- a/packaging/PKGBUILD.in
+++ b/packaging/PKGBUILD.in
@@ -51,7 +51,10 @@ depends=(
 # modules, and the rpath set at build time must survive untouched.
 options=('!strip' '!debug' '!libtool' '!staticlibs' '!zipman' '!purge' '!emptydirs')
 
-source=("jasp-desktop-${pkgver}-${pkgrel}-x86_64.tar.zst::@DOWNLOAD_URL@")
+# The remote name is content-addressed, so it is kept as the local name too: a
+# stale download left in the build directory can never be mistaken for the
+# current tarball and fail the checksum.
+source=("@DOWNLOAD_URL@")
 sha256sums=('@SHA256@')
 
 package() {