diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index c802e4442..9482dfa90 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -567,6 +567,7 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           path: dist
+          pattern: openpencil-*
       - name: Flatten artifacts
         shell: bash
         run: |
diff --git a/crates/op-host-web/tests/ci_workflow.rs b/crates/op-host-web/tests/ci_workflow.rs
index 0894aa1c8..58ba17e86 100644
--- a/crates/op-host-web/tests/ci_workflow.rs
+++ b/crates/op-host-web/tests/ci_workflow.rs
@@ -185,6 +185,20 @@ fn release_workflow_distinguishes_published_npm_packages_from_check_failures() {
     );
 }
 
+#[test]
+fn release_workflow_downloads_only_openpencil_release_artifacts() {
+    let workflow = std::fs::read_to_string(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../.github/workflows/rust-release.yml"
+    ))
+    .expect("rust-release workflow is readable");
+
+    assert!(
+        workflow.contains("pattern: openpencil-*"),
+        "release workflow should not download Docker build metadata artifacts into release assets"
+    );
+}
+
 #[test]
 fn web_smoke_page_uses_current_canvaskit_bundle_command() {
     let smoke = std::fs::read_to_string(concat!(env!("CARGO_MANIFEST_DIR"), "/smoke/step-1b.html"))