diff --git a/main.sh b/main.sh
index 118bb984..b03c99af 100755
--- a/main.sh
+++ b/main.sh
@@ -41,13 +41,12 @@ download_and_checksum() {
     retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "${url}" -o tmp
     if [[ -n "${checksum}" ]]; then
         info "verifying sha256 checksum for $(basename "${url}")"
-        echo "${checksum} *tmp" >tmp.sha256sum
         if type -P sha256sum &>/dev/null; then
-            sha256sum -c tmp.sha256sum >/dev/null
+            echo "${checksum} *tmp" | sha256sum -c - >/dev/null
         elif type -P shasum &>/dev/null; then
             # GitHub-hosted macOS runner does not install GNU Coreutils by default.
             # https://github.com/actions/runner-images/issues/90
-            shasum -a 256 -c tmp.sha256sum >/dev/null
+            echo "${checksum} *tmp" | shasum -a 256 -c - >/dev/null
         else
             bail "checksum requires 'sha256sum' or 'shasum' command; consider installing one of them or setting 'checksum' input option to 'false'"
         fi