diff --git a/scripts/release-push.js b/scripts/release-push.js
index b04c209..b6de052 100644
--- a/scripts/release-push.js
+++ b/scripts/release-push.js
@@ -118,15 +118,42 @@ const baseUrl = `${protocol}://${host}${port ? `:${port}` : ''}${remoteDir}`;
 
 // Prepare common curl flags
 const curlBase = ['curl', '--fail', '--ftp-create-dirs'];
+// Detect curl option support dynamically to stay compatible with older curl versions
+function curlSupports(opt) {
+  try {
+    const { spawnSync } = require('child_process');
+    const res = spawnSync('curl', ['--help'], { encoding: 'utf8' });
+    const out = (res.stdout || '') + (res.stderr || '');
+    return out.includes(opt);
+  } catch (_) {
+    return false;
+  }
+}
 if (protocol === 'sftp') {
-  if (sftpKnownHosts) {
+  const hasKnownHostsOpt = curlSupports('--knownhosts');
+  const hasHostpubSha256Opt = curlSupports('--hostpubsha256');
+  const hasHostpubMd5Opt = curlSupports('--hostpubmd5');
+
+  if (sftpKnownHosts && hasKnownHostsOpt) {
     curlBase.push('--knownhosts', JSON.stringify(sftpKnownHosts));
-  } else if (sftpHostPubSha256) {
+  } else if (sftpKnownHosts && !hasKnownHostsOpt) {
+    console.warn('SFTP: curl does not support --knownhosts; consider using SFTP_HOST_PUBKEY_SHA256 instead.');
+  }
+
+  if (sftpHostPubSha256 && hasHostpubSha256Opt) {
     curlBase.push('--hostpubsha256', JSON.stringify(sftpHostPubSha256));
-  } else if (sftpHostPubMd5) {
+  } else if (sftpHostPubSha256 && !hasHostpubSha256Opt) {
+    console.warn('SFTP: curl does not support --hostpubsha256; try updating curl.');
+  }
+
+  if (!sftpHostPubSha256 && sftpHostPubMd5 && hasHostpubMd5Opt) {
     curlBase.push('--hostpubmd5', JSON.stringify(sftpHostPubMd5));
-  } else {
-    console.warn('SFTP: no known_hosts or host public key provided; relying on default known_hosts.');
+  } else if (sftpHostPubMd5 && !hasHostpubMd5Opt) {
+    console.warn('SFTP: curl does not support --hostpubmd5; try updating curl.');
+  }
+
+  if (!curlBase.some(f => typeof f === 'string' && f.startsWith('--hostpub')) && !curlBase.includes('--knownhosts')) {
+    console.warn('SFTP: no host verification flags provided; relying on default known_hosts (may fail).');
   }
 }