diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b5d2aa7..f8657f8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -71,12 +71,16 @@ jobs:
         run: tools/download-disk.ps1
         if: matrix.os == 'windows-latest' && startsWith(github.ref, 'refs/tags/')
         env:
-          DISK_URL: ${{ secrets.DISK_URL }}
+          DISK_REPO: ${{ vars.DISK_REPO }}
+          DISK_TAG: ${{ vars.DISK_TAG }}
+          GH_TOKEN: ${{ secrets.IMAGES_REPO_TOKEN }}
       - name: Download disk image (sh)
         run: chmod +x tools/download-disk.sh && ./tools/download-disk.sh
         if: matrix.os != 'windows-latest' && startsWith(github.ref, 'refs/tags/')
         env:
-          DISK_URL: ${{ secrets.DISK_URL }}
+          DISK_REPO: ${{ vars.DISK_REPO }}
+          DISK_TAG: ${{ vars.DISK_TAG }}
+          GH_TOKEN: ${{ secrets.IMAGES_REPO_TOKEN }}
       - name: Install
         run: npm ci
       - name: Make
diff --git a/tools/download-disk.ps1 b/tools/download-disk.ps1
index bfe2fbc..33814f1 100644
--- a/tools/download-disk.ps1
+++ b/tools/download-disk.ps1
@@ -1,11 +1,36 @@
-mkdir images
-cd images
+$ErrorActionPreference = "Stop"
 
-$wc = New-Object System.Net.WebClient
-$wc.DownloadFile($env:DISK_URL, "$(Resolve-Path .)\images.zip")
+# Pulls the disk image from a private GitHub release.
+# Requires DISK_REPO, DISK_TAG, GH_TOKEN.
+
+if (-not $env:DISK_REPO) { Write-Host "::error::DISK_REPO not set"; exit 1 }
+if (-not $env:DISK_TAG)  { Write-Host "::error::DISK_TAG not set";  exit 1 }
+if (-not $env:GH_TOKEN)  { Write-Host "::error::GH_TOKEN not set";  exit 1 }
+
+New-Item -ItemType Directory -Force -Path images | Out-Null
+Set-Location images
+
+gh release download $env:DISK_TAG -R $env:DISK_REPO -p '*.zip' -O images.zip --clobber
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+7z t images.zip | Out-Null
+if ($LASTEXITCODE -ne 0) {
+  $size = (Get-Item images.zip).Length
+  Write-Host "::error::Downloaded file is not a valid zip (size: $size bytes)."
+  exit 1
+}
 
 7z x images.zip -y -aoa
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
 Remove-Item images.zip
 Remove-Item __MACOSX -Recurse -ErrorAction Ignore
-cd ..
-Tree ./ /F
+Set-Location ..
+
+if (-not (Test-Path images/windows95.img)) {
+  Write-Host "::error::images/windows95.img not found after extraction"
+  Get-ChildItem images
+  exit 1
+}
+
+Get-ChildItem images
diff --git a/tools/download-disk.sh b/tools/download-disk.sh
old mode 100644
new mode 100755
index d7868ac..c16e798
--- a/tools/download-disk.sh
+++ b/tools/download-disk.sh
@@ -1,10 +1,35 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Pulls the disk image from a private GitHub release.
+# Requires:
+#   DISK_REPO   - e.g. felixrieseberg/windows95-images
+#   DISK_TAG    - e.g. v5
+#   GH_TOKEN    - a token with read access to DISK_REPO (set by the workflow)
+
+: "${DISK_REPO:?DISK_REPO not set}"
+: "${DISK_TAG:?DISK_TAG not set}"
+: "${GH_TOKEN:?GH_TOKEN not set}"
 
 mkdir -p ./images
 cd ./images
-wget -O images.zip $DISK_URL
+
+gh release download "$DISK_TAG" -R "$DISK_REPO" -p '*.zip' -O images.zip --clobber
+
+if ! unzip -tq images.zip > /dev/null; then
+  echo "::error::Downloaded file is not a valid zip (size: $(wc -c < images.zip) bytes)."
+  exit 1
+fi
+
 unzip -o images.zip
-rm images.zip
-rm -r __MACOSX
+rm -f images.zip
+rm -rf __MACOSX
 cd -
-ls images
+
+if [ ! -f images/windows95.img ]; then
+  echo "::error::images/windows95.img not found after extraction"
+  ls -la images/
+  exit 1
+fi
+
+ls -la images/