diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 845305a2..7874f7dc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   release:
-    uses: open-cli-collective/.github/.github/workflows/release.yml@b6382514b809d960c6fbdc85745a60c14cde04f1 # shared .github
+    uses: open-cli-collective/.github/.github/workflows/release.yml@776a11fe7a86dccb73bccb5dbf3824fe2ec8d4af # shared .github
     with:
       # tag push is live (false); workflow_dispatch honors the checkbox. Compare
       # against both true and 'true' because a workflow_dispatch boolean input
diff --git a/docs/development.md b/docs/development.md
index 84a4814c..88c2bb91 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -182,9 +182,9 @@ shared workflow owns publish mechanics.
   `open-cli-collective/homebrew-tap` with `TAP_GITHUB_TOKEN`.
 - Chocolatey: the shared Chocolatey job rewrites
   `packaging/chocolatey/codereview-cli.nuspec` from version `0.0.0` to the release version
-  and replaces `CHECKSUM_AMD64_PLACEHOLDER` /
-  `CHECKSUM_ARM64_PLACEHOLDER` in `chocolateyInstall.ps1` before packing and
-  pushing.
+  and replaces `URL_AMD64_PLACEHOLDER`, `URL_ARM64_PLACEHOLDER`,
+  `CHECKSUM_AMD64_PLACEHOLDER`, and `CHECKSUM_ARM64_PLACEHOLDER` in
+  `chocolateyInstall.ps1` before packing and pushing.
 - winget: the shared winget job resolves the release asset URLs/checksums and
   submits `OpenCLICollective.codereview-cli` with `WINGET_GITHUB_TOKEN`;
   because this is a first-time package id, `packaging/identity.yml` keeps
diff --git a/packaging/chocolatey/tools/chocolateyInstall.ps1 b/packaging/chocolatey/tools/chocolateyInstall.ps1
index 281cb2ed..85980c2f 100644
--- a/packaging/chocolatey/tools/chocolateyInstall.ps1
+++ b/packaging/chocolatey/tools/chocolateyInstall.ps1
@@ -1,27 +1,26 @@
 $ErrorActionPreference = 'Stop'
 
-$version = $env:ChocolateyPackageVersion
 $toolsDir = Split-Path -Parent $MyInvocation.MyCommand.Definition
 
-# Checksums injected by release workflow - DO NOT EDIT MANUALLY
+# URLs and checksums injected by release workflow - DO NOT EDIT MANUALLY
+$urlAmd64 = 'URL_AMD64_PLACEHOLDER'
+$urlArm64 = 'URL_ARM64_PLACEHOLDER'
 $checksumAmd64 = 'CHECKSUM_AMD64_PLACEHOLDER'
 $checksumArm64 = 'CHECKSUM_ARM64_PLACEHOLDER'
 
 if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
     $arch = 'arm64'
+    $url = $urlArm64
     $checksum = $checksumArm64
 } elseif ([Environment]::Is64BitOperatingSystem) {
     $arch = 'amd64'
+    $url = $urlAmd64
     $checksum = $checksumAmd64
 } else {
     throw "32-bit Windows is not supported. cr requires 64-bit Windows."
 }
 
-$baseUrl = "https://github.com/open-cli-collective/codereview-cli/releases/download/v${version}"
-$zipFile = "cr_v${version}_windows_${arch}.zip"
-$url = "${baseUrl}/${zipFile}"
-
-Write-Host "Installing cr ${version} for Windows ${arch}..."
+Write-Host "Installing cr for Windows ${arch}..."
 Write-Host "URL: ${url}"
 Write-Host "Checksum (SHA256): ${checksum}"
 
diff --git a/scripts/verify-package-render.sh b/scripts/verify-package-render.sh
index e4af2118..449e9784 100755
--- a/scripts/verify-package-render.sh
+++ b/scripts/verify-package-render.sh
@@ -53,10 +53,8 @@ for kind in deb rpm; do
   done
 done
 
-# Winget and Chocolatey keep version/checksum placeholders in source; the shared
-# release workflow substitutes them from the real release assets before publish.
-# The generated windows archives above prove the archive naming those templates
-# reference is rendered by GoReleaser.
+# Winget keeps version/checksum placeholders; Chocolatey keeps URL/checksum
+# placeholders. The shared release workflow substitutes them before publish.
 require_grep "winget: { id: OpenCLICollective.codereview-cli, bootstrap: true }" "packaging/identity.yml"
 require_grep "chocolatey: { id: codereview-cli }" "packaging/identity.yml"
 
@@ -81,8 +79,8 @@ require_grep "cr_v0.0.0_windows_arm64.zip" "$winget_installer"
 require_file "packaging/chocolatey/codereview-cli.nuspec"
 require_file "packaging/chocolatey/tools/chocolateyInstall.ps1"
 require_grep "<id>codereview-cli</id>" "packaging/chocolatey/codereview-cli.nuspec"
-require_grep 'releases/download/v${version}' "packaging/chocolatey/tools/chocolateyInstall.ps1"
-require_grep 'cr_v${version}_windows_${arch}.zip' "packaging/chocolatey/tools/chocolateyInstall.ps1"
+require_grep 'URL_AMD64_PLACEHOLDER' "packaging/chocolatey/tools/chocolateyInstall.ps1"
+require_grep 'URL_ARM64_PLACEHOLDER' "packaging/chocolatey/tools/chocolateyInstall.ps1"
 
 require_grep 'homebrew-tap-token: ${{ secrets.TAP_GITHUB_TOKEN }}' ".github/workflows/release.yml"
 require_grep 'chocolatey-api-key: ${{ secrets.CHOCOLATEY_API_KEY }}' ".github/workflows/release.yml"