diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml
index cb0094f1..aa7a1e66 100644
--- a/.github/workflows/release-provenance.yml
+++ b/.github/workflows/release-provenance.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Upload tarballs to the release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" -- release-artifacts/*.tgz --clobber
+        run: gh release upload "${{ github.event.release.tag_name }}" --clobber -- release-artifacts/*.tgz
 
   provenance:
     needs: [build-artifacts]