diff --git a/rivet-cli/installer.rkt b/rivet-cli/installer.rkt
index 5073dfc0..41516e51 100644
--- a/rivet-cli/installer.rkt
+++ b/rivet-cli/installer.rkt
@@ -486,8 +486,9 @@
   ;; deb/rpm integrate with the distribution package manager, while AppImage
   ;; carries its own GTK4 dependency closure and becomes the signed in-place
   ;; update payload when enabled.
-  (for ([format (in-list (project-linux-formats project))])
-    (case format
+  ;; `fmt`, not `format`: the builtin stays reachable inside the branches.
+  (for ([fmt (in-list (project-linux-formats project))])
+    (case fmt
       [("deb") (create-deb! project package)]
       [("rpm") (create-rpm! project package)]
       [("appimage") (create-appimage! project package)]))
diff --git a/rivet-cli/main.rkt b/rivet-cli/main.rkt
index a32f2b42..14dea418 100644
--- a/rivet-cli/main.rkt
+++ b/rivet-cli/main.rkt
@@ -247,14 +247,14 @@
      (say "release installer: ~a" installer)
      (say "portable zip: ~a" portable-zip)
      (when (eq? (system-type 'os) 'unix)
-       (for ([format (in-list ((command "project" 'project-linux-formats)
-                               (current-project!)))])
+       (for ([fmt (in-list ((command "project" 'project-linux-formats)
+                            (current-project!)))])
          (define extra
-           (case format
+           (case fmt
              [("deb") ((command "deb" 'deb-installer-path) (current-project!))]
              [("rpm") ((command "rpm" 'rpm-installer-path) (current-project!))]
              [("appimage") ((command "appimage" 'appimage-installer-path) (current-project!))]))
-         (say "release ~a: ~a" format extra)))
+         (say "release ~a: ~a" fmt extra)))
      (if manifest
          (say "signed update manifest: ~a" manifest)
          (say "update manifest: skipped (--without-updates)"))
diff --git a/rivet-cli/verify.rkt b/rivet-cli/verify.rkt
index 030e78df..be214f9e 100644
--- a/rivet-cli/verify.rkt
+++ b/rivet-cli/verify.rkt
@@ -222,8 +222,11 @@
 ;; broken installer cannot pass a release gate.
 (define (verify-linux-native-installers! project)
   (define who 'verify-package!)
-  (for ([format (in-list (project-linux-formats project))])
-    (case format
+  ;; The loop variable must not be named `format`: the branches below call
+  ;; the format builtin, and the shadow turned "deb" into a procedure
+  ;; application (rivet #320).
+  (for ([fmt (in-list (project-linux-formats project))])
+    (case fmt
       [("deb")
        (define installer (deb-installer-path project))
        (required-file! who installer "deb installer")
diff --git a/rivet/tests/linux-installer.rkt b/rivet/tests/linux-installer.rkt
index e3a4e3eb..dd30b658 100644
--- a/rivet/tests/linux-installer.rkt
+++ b/rivet/tests/linux-installer.rkt
@@ -297,6 +297,23 @@
                              #:production? #t
                              #:launch-smoke? #f))))))
 
+      ;; Regression for rivet #320: the native-installer verification loop
+      ;; named its variable `format`, shadowing the builtin, so verifying a
+      ;; project with linux-formats applied the string "deb" as a procedure.
+      ;; Building and verifying a real deb exercises that branch end to end.
+      (define deb-project
+        (rivet-project package-root (hasheq 'name "Smoke" 'linux-formats '("deb"))))
+      (with-production-env
+       (lambda ()
+         (create-installer! deb-project package #:production? #t)))
+      (check-equal?
+       (with-production-env
+        (lambda ()
+          (verify-package! deb-project package
+                           #:production? #t
+                           #:launch-smoke? #f)))
+       package)
+
     (delete-file private-key-path)
     (delete-file public-key-path))