gh handles the release-asset redirects; the SHA-256 check
against the published checksum is what stays in Ruby.

Assisted-by: GLM-5.3 via pi

diff --git a/Rakefile b/Rakefile
index 44018b1..fcc9ca3 100644
--- a/Rakefile
+++ b/Rakefile
@@ -3,9 +3,9 @@
 $LOAD_PATH.unshift(File.expand_path("lib", __dir__))
 
 require "digest"
-require "net/http"
 require "rbconfig"
 require "fileutils"
+require "tmpdir"
 require "hegel/libhegel_version"
 
 require "minitest/test_task"
@@ -14,13 +14,13 @@ Minitest::TestTask.create
 
 # The hegeltest gem drives a native libhegel engine that ships separately
 # (the gem is pre-release and bundles no binary yet). This task stages it
-# for the host platform, mirroring hegel-ruby's own libhegel:fetch: the
-# release asset matching the gem's engine version, verified against its
-# published SHA-256, installed under tmp/libhegel/<version>/ (gitignored).
-# The version comes from the gem — the binding targets a specific engine
-# ABI, so the gem is the source of truth, not this file. The directory form
-# of HEGEL_LIBHEGEL_PATH in .envrc resolves whichever platform's asset
-# landed there.
+# for the host platform: the release asset matching the gem's engine
+# version, downloaded with gh (which handles the CDN redirects), verified
+# against its published SHA-256, and installed under tmp/libhegel/<version>/
+# (gitignored). The version comes from the gem — the binding targets a
+# specific engine ABI, so the gem is the source of truth, not this file.
+# The directory form of HEGEL_LIBHEGEL_PATH in .envrc resolves whichever
+# platform's asset landed there.
 LIBHEGEL_VERSION = Hegel::LIBHEGEL_VERSION
 LIBHEGEL_ASSETS = {
   "arm64-darwin" => "libhegel-darwin-arm64.dylib",
@@ -42,34 +42,21 @@ end
 LIBHEGEL_DIR = File.expand_path("tmp/libhegel/#{LIBHEGEL_VERSION}", __dir__)
 LIBHEGEL_PATH = File.join(LIBHEGEL_DIR, libhegel_asset_name)
 
-# Minimal redirect-following GET: GitHub release assets 302 to a CDN.
-def http_get(uri, limit = 5)
-  raise "too many redirects" if limit.zero?
-
-  response = Net::HTTP.get_response(URI(uri))
-  case response
-  when Net::HTTPRedirection then http_get(response["location"], limit - 1)
-  when Net::HTTPSuccess then response.body
-  else raise "GET #{uri}: #{response.code} #{response.message}"
-  end
-end
-
-def download_libhegel(path)
-  base = "https://github.com/hegeldev/hegel-rust/releases/download/v#{LIBHEGEL_VERSION}"
-  asset = File.basename(path)
-  bytes = http_get("#{base}/#{asset}")
-  expected = http_get("#{base}/#{asset}.sha256").split.first
-  actual = Digest::SHA256.hexdigest(bytes)
-  raise "SHA-256 mismatch for #{asset}: expected #{expected}, got #{actual}" unless actual == expected
-
-  FileUtils.mkdir_p(File.dirname(path))
-  tmp = "#{path}.#{Process.pid}.partial"
-  File.binwrite(tmp, bytes)
-  File.rename(tmp, path)
-end
-
 file LIBHEGEL_PATH do |task|
-  download_libhegel(task.name)
+  asset = File.basename(task.name)
+  Dir.mktmpdir do |staging|
+    sh "gh", "release", "download", "v#{LIBHEGEL_VERSION}",
+      "--repo", "hegeldev/hegel-rust",
+      "--pattern", asset, "--pattern", "#{asset}.sha256",
+      "--dir", staging
+
+    expected = File.read(File.join(staging, "#{asset}.sha256")).split.first
+    actual = Digest::SHA256.hexdigest(File.binread(File.join(staging, asset)))
+    raise "SHA-256 mismatch for #{asset}: expected #{expected}, got #{actual}" unless actual == expected
+
+    FileUtils.mkdir_p(LIBHEGEL_DIR)
+    FileUtils.mv(File.join(staging, asset), task.name)
+  end
 end
 
 # Keep the rake invocation self-contained: the engine resolves through