diff --git a/arcup/arcup b/arcup/arcup
index 3590cd36..8deb997c 100755
--- a/arcup/arcup
+++ b/arcup/arcup
@@ -6,7 +6,7 @@ set -euo pipefail
 
 # NOTE: if you make modifications to this script, please increment the version number.
 # WARNING: the SemVer pattern: major.minor.patch must be followed as we use it to determine if the script is up to date.
-ARCUP_INSTALLER_VERSION="0.2.0"
+ARCUP_INSTALLER_VERSION="0.2.1"
 
 REPO="${ARC_REPO:-circlefin/arc-node}"
 if [[ -n "${ARC_REPO:-}" ]] && [[ ! "$ARC_REPO" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
@@ -664,6 +664,11 @@ verify_checksum_file() {
         error "Checksum file has invalid SHA-256 hash: $checksum_path"
     fi
 
+    # sha256sum and shasum both print lowercase, but the format accepted above allows
+    # either case, so fold to lowercase before comparing — otherwise a valid digest
+    # written in uppercase fails as a mismatch. Same normalization detect_platform uses.
+    expected_checksum="$(printf '%s' "$expected_checksum" | tr '[:upper:]' '[:lower:]')"
+
     if [[ -n "$expected_name" ]]; then
         expected_name="${expected_name#\*}"
         expected_name="${expected_name##*/}"
diff --git a/arcup/test_arcup.sh b/arcup/test_arcup.sh
index 49021191..577a800d 100755
--- a/arcup/test_arcup.sh
+++ b/arcup/test_arcup.sh
@@ -117,6 +117,10 @@ test_checksum_validation() {
     verify_checksum_file "$archive" "$checksum_file" "$archive_name"
     pass "valid checksum file passes"
 
+    printf '%s  %s\n' "$(printf '%s' "$checksum" | tr '[:lower:]' '[:upper:]')" "$archive_name" > "$checksum_file"
+    verify_checksum_file "$archive" "$checksum_file" "$archive_name"
+    pass "uppercase checksum digest passes"
+
     printf '%s  other-asset.tar.gz\n' "$checksum" > "$checksum_file"
     expect_fail "checksum filename mismatch fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name"
 }