diff --git a/index.json b/index.json
index a9a59a3..b1bed81 100644
--- a/index.json
+++ b/index.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "updated_at": "2026-05-23T13:59:37+08:00",
+  "updated_at": "2026-05-27T17:06:40+08:00",
   "scripts": [
     {
       "id": "codex-token-usage",
@@ -11,7 +11,7 @@
       "tags": ["codex", "tokens", "usage", "metrics"],
       "homepage": "https://github.com/kokotao/codex-token-usage-script",
       "script_url": "https://raw.githubusercontent.com/kokotao/codex-token-usage-script/main/scripts/codex-token-usage.js",
-      "sha256": "a163bd62d886cd738adaa3966cfc92465892cea2cc9d4fd1dabecc4cc517fd2a"
+      "sha256": "cee3188c1a90083f27c01d3e1d48af42b074b0e38f05507c970f18145f376ad5"
     }
   ]
 }
diff --git a/tests/codex-token-usage.test.js b/tests/codex-token-usage.test.js
index e7fbef7..1615363 100644
--- a/tests/codex-token-usage.test.js
+++ b/tests/codex-token-usage.test.js
@@ -1,14 +1,18 @@
 const assert = require("node:assert/strict");
+const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
 const test = require("node:test");
 const vm = require("node:vm");
 
+const SCRIPT_PATH = path.join(__dirname, "..", "scripts", "codex-token-usage.js");
+
+function readScriptForDistribution() {
+  return fs.readFileSync(SCRIPT_PATH, "utf8").replace(/\r\n/g, "\n");
+}
+
 function loadHelpers() {
-  const source = fs.readFileSync(
-    path.join(__dirname, "..", "scripts", "codex-token-usage.js"),
-    "utf8",
-  );
+  const source = readScriptForDistribution();
   const sandbox = {
     console,
     setTimeout,
@@ -67,6 +71,20 @@ function loadHelpers() {
   return sandbox.window.__codexTokenUsageScriptTest;
 }
 
+test("index checksum matches distributed script bytes", () => {
+  const index = JSON.parse(
+    fs.readFileSync(path.join(__dirname, "..", "index.json"), "utf8"),
+  );
+  const script = index.scripts.find((item) => item.id === "codex-token-usage");
+  const hash = crypto
+    .createHash("sha256")
+    .update(readScriptForDistribution(), "utf8")
+    .digest("hex");
+
+  assert.ok(script, "codex-token-usage script entry exists");
+  assert.equal(script.sha256, hash);
+});
+
 test("extractUsage finds Responses API usage from JSON", () => {
   const helpers = loadHelpers();
   const usage = helpers.extractUsage({