diff --git a/iso/builder/build-cublas.sh b/iso/builder/build-cublas.sh
index dc9aab6..120afc8 100644
--- a/iso/builder/build-cublas.sh
+++ b/iso/builder/build-cublas.sh
@@ -77,26 +77,26 @@ download_verified_pkg() {
     if [ -f "$out" ]; then
         actual_sha="$(sha256sum "$out" | awk '{print $1}')"
         if [ "$actual_sha" = "$repo_sha" ]; then
-            echo "=== using cached $(basename "$repo_file") ==="
+            echo "=== using cached $(basename "$repo_file") ===" >&2
             printf '%s\n' "$out"
             return 0
         fi
-        echo "=== removing stale $(basename "$repo_file") (sha256 mismatch) ==="
+        echo "=== removing stale $(basename "$repo_file") (sha256 mismatch) ===" >&2
         rm -f "$out"
     fi
 
-    echo "=== downloading $(basename "$repo_file") ==="
+    echo "=== downloading $(basename "$repo_file") ===" >&2
     wget --show-progress -O "$out" "${REPO_BASE}/$(basename "$repo_file")"
 
     actual_sha="$(sha256sum "$out" | awk '{print $1}')"
     if [ "$actual_sha" != "$repo_sha" ]; then
-        echo "ERROR: sha256 mismatch for $(basename "$repo_file")"
-        echo "  expected: $repo_sha"
-        echo "  actual:   $actual_sha"
+        echo "ERROR: sha256 mismatch for $(basename "$repo_file")" >&2
+        echo "  expected: $repo_sha" >&2
+        echo "  actual:   $actual_sha" >&2
         rm -f "$out"
         exit 1
     fi
-    echo "sha256 OK: $(basename "$repo_file")"
+    echo "sha256 OK: $(basename "$repo_file")" >&2
     printf '%s\n' "$out"
 }