diff --git a/.gitea/workflows/auto-pr-tofu-plan.yml b/.gitea/workflows/auto-pr-tofu-plan.yml
index ad2a27d..88fb799 100644
--- a/.gitea/workflows/auto-pr-tofu-plan.yml
+++ b/.gitea/workflows/auto-pr-tofu-plan.yml
@@ -72,17 +72,18 @@ jobs:
           TEA_DL_URL: "https://dl.gitea.com/tea/${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64"
         shell: bash
         run: |
+          set -euo pipefail
           cd /tmp
+
           wget -q "${TEA_DL_URL}"
           wget -q "${TEA_DL_URL}.sha256"
 
-          if sha256sum --quiet -c "tea-${TEA_VERSION}-linux-amd64.sha256"; then
-            mv "tea-${TEA_VERSION}-linux-amd64" /usr/bin/tea
-            chmod +x /usr/bin/tea
-          else
-            echo "WARNING ⛔: Tea v${TEA_VERSION} Checksum Failed"
-            exit 1
-          fi
+          # Extract hash and manually verify file
+          sha_value=$(cat "tea-${TEA_VERSION}-linux-amd64.sha256")
+          echo "${sha_value}  tea-${TEA_VERSION}-linux-amd64" | sha256sum -c -
+
+          mv "tea-${TEA_VERSION}-linux-amd64" /usr/bin/tea
+          chmod +x /usr/bin/tea
 
           pr_number=$(tea pr ls --repo "${{ gitea.repository }}" \
             --state open \
@@ -93,6 +94,7 @@ jobs:
           echo "${pr_number}"
           echo "pr_number=${pr_number}" >> "$GITHUB_OUTPUT"
 
+
       - name: Generate .env from Hashicorp Vault
         uses: https://git.trez.wtf/Trez/hc-vault-env@main
         with: