diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 905342ad..1e53ddd4 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -15,8 +15,9 @@ jobs:
       - name: Set CPM version by tag
         run: |
           mkdir dist
-          sed "s/1.0.0-development-version/${GITHUB_REF/refs\/tags\/v}/g" cmake/CPM.cmake > dist/CPM.cmake
-          sed "s/1.0.0-development-version/${GITHUB_REF/refs\/tags\/v}/g" cmake/get_cpm.cmake > dist/get_cpm.cmake
+          sed -e "s/1.0.0-development-version/${GITHUB_REF/refs\/tags\//v}/g" cmake/CPM.cmake > dist/CPM.cmake
+          sed -e "s/1.0.0-development-version/${GITHUB_REF/refs\/tags\//v}/g" \
+              -e "s/EMPTY_HASH_SUM/$(sha256sum cmake/CPM.cmake | cut -d' ' -f1)/" cmake/get_cpm.cmake > dist/get_cpm.cmake
 
       - name: Upload CPM.cmake to release
         uses: svenstaro/upload-release-action@v1-release
diff --git a/cmake/get_cpm.cmake b/cmake/get_cpm.cmake
index 567ad605..f56d803d 100644
--- a/cmake/get_cpm.cmake
+++ b/cmake/get_cpm.cmake
@@ -3,6 +3,7 @@
 # SPDX-FileCopyrightText: Copyright (c) 2019-2023 Lars Melchior and contributors
 
 set(CPM_DOWNLOAD_VERSION 1.0.0-development-version)
+set(CPM_HASH_SUM "HASH_SUM_PLACEHOLDER")
 
 if(CPM_SOURCE_CACHE)
   set(CPM_DOWNLOAD_LOCATION "${CPM_SOURCE_CACHE}/cpm/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
@@ -15,23 +16,20 @@ endif()
 # Expand relative path. This is important if the provided path contains a tilde (~)
 get_filename_component(CPM_DOWNLOAD_LOCATION ${CPM_DOWNLOAD_LOCATION} ABSOLUTE)
 
-function(download_cpm)
-  message(STATUS "Downloading CPM.cmake to ${CPM_DOWNLOAD_LOCATION}")
-  file(DOWNLOAD
-       https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_DOWNLOAD_VERSION}/CPM.cmake
-       ${CPM_DOWNLOAD_LOCATION}
-  )
-endfunction()
-
-if(NOT (EXISTS ${CPM_DOWNLOAD_LOCATION}))
-  download_cpm()
+message(STATUS "Downloading CPM.cmake to ${CPM_DOWNLOAD_LOCATION}")
+file(
+  DOWNLOAD
+  https://github.com/cpm-cmake/CPM.cmake/releases/download/v${CPM_DOWNLOAD_VERSION}/CPM.cmake
+  ${CPM_DOWNLOAD_LOCATION}
+  STATUS CPM_DOWNLOAD_STATUS
+  EXPECTED_HASH SHA256=${CPM_HASH_SUM}
+)
+list(GET CPM_DOWNLOAD_STATUS 0 CPM_DOWNLOAD_STATUS_CODE)
+list(GET CPM_DOWNLOAD_STATUS 1 CPM_DOWNLOAD_ERROR_MESSAGE)
+if(${CPM_DOWNLOAD_STATUS_CODE} EQUAL 0)
+  message(STATUS "CPM: Download completed successfully.")
 else()
-  # resume download if it previously failed
-  file(READ ${CPM_DOWNLOAD_LOCATION} check)
-  if("${check}" STREQUAL "")
-    download_cpm()
-  endif()
-  unset(check)
+  message(FATAL_ERROR "CPM: Error occurred during download: ${CPM_DOWNLOAD_ERROR_MESSAGE}")
 endif()
 
 include(${CPM_DOWNLOAD_LOCATION})