diff --git a/.github/workflows/deployment-ci.yml b/.github/workflows/deployment-ci.yml
index 5142266..e260207 100644
--- a/.github/workflows/deployment-ci.yml
+++ b/.github/workflows/deployment-ci.yml
@@ -214,6 +214,38 @@ jobs:
           chmod 700 "$GNUPGHOME"
           gpg --batch --no-default-keyring --keyring dist/apt-ci/repo/gitcomet-archive-keyring.gpg --verify dist/apt-ci/repo/dists/stable/InRelease >/dev/null
 
+      - name: Verify generated repo with apt-secure
+        run: |
+          set -euo pipefail
+
+          repo_root="$(pwd)/dist/apt-ci/repo"
+          source_dir="${RUNNER_TEMP}/gitcomet-apt-sources.d"
+          lists_dir="${RUNNER_TEMP}/gitcomet-apt-lists"
+
+          mkdir -p "$source_dir"
+          sudo mkdir -p "${lists_dir}/partial"
+
+          cat > "${source_dir}/gitcomet-ci.sources" <<EOF
+          Types: deb
+          URIs: file://${repo_root}
+          Suites: stable
+          Components: main
+          Architectures: amd64
+          Signed-By: ${repo_root}/gitcomet-archive-keyring.gpg
+          EOF
+
+          sudo apt-get update \
+            -o Dir::Etc::sourcelist=/dev/null \
+            -o Dir::Etc::sourceparts="${source_dir}" \
+            -o Dir::State::lists="${lists_dir}" \
+            -o APT::Get::List-Cleanup=0
+
+          apt-cache policy gitcomet \
+            -o Dir::Etc::sourcelist=/dev/null \
+            -o Dir::Etc::sourceparts="${source_dir}" \
+            -o Dir::State::lists="${lists_dir}" \
+            | grep -q '0.0.0~ci1'
+
   macos-packaging-smoke:
     name: macOS packaging smoke (${{ matrix.arch }})
     runs-on: ${{ matrix.runs_on }}
diff --git a/scripts/build-apt-repo.sh b/scripts/build-apt-repo.sh
index c7ca399..f6a2688 100755
--- a/scripts/build-apt-repo.sh
+++ b/scripts/build-apt-repo.sh
@@ -199,9 +199,10 @@ write_release_checksums() {
       -printf '%P\n' \
       | LC_ALL=C sort
   )
-  echo ""
 }
 
+# `Release` is parsed as a single deb822 paragraph. Blank lines would split
+# the checksum stanzas into separate paragraphs and make APT ignore them.
 {
   echo "Origin: ${origin}"
   echo "Label: ${label}"
@@ -211,7 +212,6 @@ write_release_checksums() {
   echo "Architectures: ${architecture}"
   echo "Components: ${component}"
   echo "Description: ${description}"
-  echo ""
   write_release_checksums "MD5Sum" md5sum
   write_release_checksums "SHA256" sha256sum
   write_release_checksums "SHA512" sha512sum