diff --git a/roles/promtail/defaults/main.yml b/roles/promtail/defaults/main.yml
index 950d514..15e042c 100644
--- a/roles/promtail/defaults/main.yml
+++ b/roles/promtail/defaults/main.yml
@@ -1,7 +1,8 @@
 ---
 promtail_arch: "{{ (ansible_architecture | default('amd64')) | replace('x86_64', 'amd64') }}"
 promtail_os: linux
-promtail_url: https://github.com/grafana/loki/releases/download/v{{ promtail_version | regex_replace('^v', '') }} /promtail-{{ promtail_os }}-{{ promtail_arch }}.zip
+promtail_url: https://github.com/grafana/loki/releases/download/v{{ promtail_version | regex_replace('^v', '') }}/promtail-{{ promtail_os }}-{{ promtail_arch }}.zip
+promtail_sha256sum_url: https://github.com/grafana/loki/releases/download/v{{ promtail_version | regex_replace('^v', '') }}/SHA256SUMS
 promtail_version: 3.2.0
 
 promtail_user: promtail
diff --git a/roles/promtail/tasks/setup-Debian.yml b/roles/promtail/tasks/setup-Debian.yml
index 3a4b81f..4b7be1a 100644
--- a/roles/promtail/tasks/setup-Debian.yml
+++ b/roles/promtail/tasks/setup-Debian.yml
@@ -1,4 +1,12 @@
 ---
+- name: Download and read sha256sum file
+  ansible.builtin.set_fact:
+    sha256sum_file_content: "{{ lookup('ansible.builtin.url', promtail_sha256sum_url, wantlist=True) }}"
+  when: promtail_version and promtail_sha256sum_url
+- name: Extract SHA256 checksums for {{ promtail_download_url | basename }}
+  ansible.builtin.set_fact:
+    sha256sum: "{{ sha256sum_file_content | select('search', promtail_download_url | basename) | map('split', ' ') | map('first') | list | first }}"
+  when: promtail_version and promtail_sha256sum_url
 - name: Download promtail
   ansible.builtin.get_url:
     url: "{{ promtail_url }}"
@@ -6,7 +14,7 @@
     mode: "0444"
     owner: "{{ promtail_user }}"
     group: "{{ promtail_group }}"
-    checksum: "sha256:{{ promtail_checksum }}"
+    checksum: "{{ 'sha256:' + sha256sum if sha256sum else None }}"
   register: promtail_download
 - name: Extract promtail
   ansible.builtin.unarchive: