diff --git a/.tangled/workflows/build.yml b/.tangled/workflows/build.yml
index cd656ee..1d7a8d2 100644
--- a/.tangled/workflows/build.yml
+++ b/.tangled/workflows/build.yml
@@ -13,6 +13,7 @@ dependencies:
         - minisign
         - gnutar
         - xz
+        - zip
 
 environment:
     ZIG_VERSION: "0.15.1"
diff --git a/zig/download.sh b/zig/download.sh
index f6a99e0..e2af150 100755
--- a/zig/download.sh
+++ b/zig/download.sh
@@ -2,9 +2,6 @@
 set -e
 
 [ -z "$ZIG_VERSION" ] && ZIG_VERSION="master"
-
-ZIG_SIGNATUR_PUBKEY="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"
-
 command -v jq >/dev/null || { echo "Error: jq is required to parse Zig's download manifest"; exit 1; }
 command -v minisign >/dev/null || { echo "Error: minisign is required to verify Zig's signature"; exit 1; }
 mkdir -p zig
@@ -33,12 +30,51 @@ u=$(curl -s https://ziglang.org/download/index.json | jq -r ".\"$ZIG_VERSION\".\
 [ -z "$u" ] && { echo "Error: Could not find download URL for version $ZIG_VERSION on $p"; exit 1; }
 
 f=$(basename "$u")
+echo "Downloading $u to zig/$f..."
 curl -L "$u" -o "zig/$f" || { echo "Error: Failed to download Zig compiler"; exit 1; }
 curl -L "$u.minisig" -o "zig/$f.minisig" || { echo "Error: Failed to download minisig signature"; exit 1; }
+echo "RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U" > zig/zig.pub
+echo "Verifying signature..."
+minisign -Vm "zig/$f" -P zig/zig.pub || { echo "Error: Signature verification failed - this is critical for security"; exit 1; }
+
+# Create temporary extraction directory
+mkdir -p zig/extract
+
+# Extract to temporary location with --no-same-owner for CI environments
+if [[ "$f" == *.zip ]]; then
+  echo "Extracting ZIP archive..."
+  unzip -q "zig/$f" -d zig/extract
+else
+  echo "Extracting TAR archive with --no-same-owner (fixes CI permission issues)..."
+  tar -xJf "zig/$f" --no-same-owner -C zig/extract
+fi
+
+# Find the first directory at the top level (should be the Zig directory)
+d=$(find "zig/extract" -mindepth 1 -maxdepth 1 -type d -print -quit)
+if [ -z "$d" ]; then
+  echo "Error: Could not determine extracted directory structure"
+  echo "Contents of extract directory:"
+  ls -la zig/extract
+  exit 1
+fi
+d=$(basename "$d")
+
+echo "Found Zig directory: $d"
+
+# Verify the binary exists before creating symlink
+if [ ! -f "zig/extract/$d/bin/zig" ]; then
+  echo "Error: Zig binary not found at expected location: zig/extract/$d/bin/zig"
+  echo "Available files:"
+  find "zig/extract" -type f
+  exit 1
+fi
 
-minisign -Vm "zig/$f" -P $ZIG_SIGNATUR_PUBKEY || { echo "Error: Signature verification failed - this is critical for security"; exit 1; }
+# Create symlink with verification
+ln -sfv "zig/extract/$d/bin/zig" zig/zig || { echo "Error: Failed to create symlink"; exit 1; }
 
-[[ "$f" == *.zip ]] && unzip -q "zig/$f" -d zig && d=$(unzip -l "zig/$f" | awk 'NR==4 {print $4}' | cut -d '/' -f 1) || { tar -xJf "zig/$f" -C zig; d=$(tar -tf "zig/$f" | head -1 | cut -d '/' -f 1); }
+# Cleanup
+rm -f "zig/$f" "zig/$f.minisig" zig/zig.pub
+rm -rf "zig/extract"
 
-ln -sf "$(pwd)/zig/$d/zig" $(pwd)/zig/zig
-rm -f "zig/$f" "zig/$f.minisig"
+echo "Zig compiler installed successfully!"
+echo "Run with: ./zig/zig --version"