diff --git a/.github/workflows/hosted-kache-canary.yml b/.github/workflows/hosted-kache-canary.yml
index a6ce8ea..ecea155 100644
--- a/.github/workflows/hosted-kache-canary.yml
+++ b/.github/workflows/hosted-kache-canary.yml
@@ -85,7 +85,10 @@ jobs:
           kache daemon stop
           kache sync --push --manifest-path "$CANARY_MANIFEST" 2>&1 \
             | tee "$RUNNER_TEMP/kache-seed-sync.log"
-          grep -Eq 'Uploaded:[[:space:]]+1/1' "$RUNNER_TEMP/kache-seed-sync.log"
+          # The daemon may already have uploaded the entry while compiling.
+          # The fresh verify runner must still download it and record a cache hit.
+          grep -Eq 'Uploaded:[[:space:]]+1/1|Listing remote keys\.\.\.[[:space:]]+1 keys' \
+            "$RUNNER_TEMP/kache-seed-sync.log"
       - name: Record seed evidence
         run: |
           kache report --format json \
diff --git a/tests/test_validate.py b/tests/test_validate.py
index bdae272..c915cb3 100644
--- a/tests/test_validate.py
+++ b/tests/test_validate.py
@@ -200,6 +200,10 @@ def test_canary_upload_is_scoped_to_its_build_root(self) -> None:
         self.assertIn('kache sync --push --manifest-path "$CANARY_MANIFEST"', upload["run"])
         self.assertLess(upload["run"].index("kache daemon stop"), upload["run"].index("kache sync"))
         self.assertIn("Uploaded:", upload["run"])
+        self.assertIn("Listing remote keys", upload["run"])
+        verify = workflow["jobs"]["verify"]["steps"]
+        self.assertTrue(any("Downloaded:" in step.get("run", "") for step in verify))
+        self.assertTrue(any(".misses == 0" in step.get("run", "") for step in verify))
 
     def test_platform_release_cache_stays_credentialless(self) -> None:
         workflow = yaml.load(