diff --git a/action.yml b/action.yml
index d027208..ace662e 100644
--- a/action.yml
+++ b/action.yml
@@ -97,15 +97,23 @@ runs:
     - name: Generate SHA-256 checksum file (*nix)
       shell: bash
       run: |
+        set -e
+        set -x
+
         shasum -a 256 \
             "${{ steps.package-archive.outputs.archive-basename }}" \
             > "${{ steps.package-archive.outputs.archive-basename }}.sha256"
       if: runner.os != 'Windows'
+    - name: Install psutils on Windows
+      shell: powershell
+      run: choco install --ignore-checksums psutils
+      if: runner.os == 'Windows'
     - name: Generate SHA-256 checksum file (Windows)
       shell: powershell
       run: |
-        $hash = $(CertUtil -hashfile ${{ steps.package-archive.outputs.archive-basename }} SHA256)[1]
-        echo "${{ steps.package-archive.outputs.archive-basename }}  $hash" > "${{ steps.package-archive.outputs.archive-basename }}.sha256"
+        shasum -a 256 `
+            "${{ steps.package-archive.outputs.archive-basename }}" `
+            > "${{ steps.package-archive.outputs.archive-basename }}.sha256"
       if: runner.os == 'Windows'
     - name: Publish release artifact for run
       id: publish-release-artifact
diff --git a/tests/check-release.pl b/tests/check-release.pl
index 1752236..acc3d3c 100755
--- a/tests/check-release.pl
+++ b/tests/check-release.pl
@@ -59,9 +59,7 @@ sub main {
     my ( $checksum, $filename ) = $sha256_contents =~ /^(\S+)  (\S+)$/;
     is( $filename, $archive_file, "filename in checksum file matches archive filename" )
         or diag($sha256_contents);
-    my $shasum
-        = $^O eq 'MSWin32' ? 'c/programdata/chocolatey/lib/psutils/tools/shasum.ps1' : 'shasum';
-    my $output = capturex( $shasum, '--algorithm', '256', '--check', $checksum_file );
+    my $output = capturex( 'shasum', '--algorithm', '256', '--check', $checksum_file );
     like( $output, qr/\Q$archive_file\E: OK/, 'sha256sum reports checksum is OK' );
 
     if ( $archive_file =~ /\.zip$/ ) {