diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fca8353..956cfc4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,6 +70,22 @@ jobs:
       contents: write
     steps:
     - uses: actions/checkout@v7
+      with:
+        fetch-depth: 0
+
+    # Squash-merging a pull request rewrites the commit, so a tag pushed to the
+    # pre-merge branch tip builds and tests green while pointing at a commit
+    # reachable only from the tag. Publishing that produces a release whose
+    # history is not on main, which is only noticed much later by whoever pins
+    # it. Refuse the tag instead.
+    - name: Verify the tag is on main
+      run: |
+        git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+        if ! git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/main; then
+          echo "::error::$GITHUB_REF_NAME ($GITHUB_SHA) is not an ancestor of main. Delete the tag, then re-tag the merged commit on main." >&2
+          exit 1
+        fi
+        echo "$GITHUB_REF_NAME is on main."
 
     # One platform-independent, buildable source archive (headers + sources +
     # CMake config). GitHub also attaches auto-generated "Source code" archives.
@@ -81,12 +97,16 @@ jobs:
     - name: Extract release notes from CHANGELOG
       run: |
         version="${GITHUB_REF_NAME#v}"
-        awk -v v="$version" '
-          $0 ~ "^## \\[" v "\\]" { found = 1; next }   # heading for this version
-          found && /^## \[/       { exit }             # next version heading
-          found && /^\[.*\]: /    { exit }             # link reference block
-          found && /^<!--/        { exit }             # trailing comments
-          found                   { print }
+        # Match the heading by prefix rather than by regex: a version string
+        # interpolated into a regex turns "[0.3.0]" into a character class, and
+        # whether the escaping survives depends on the awk in use (mawk keeps
+        # the backslash, gawk drops it and silently matches nothing).
+        awk -v head="## [$version]" '
+          index($0, head) == 1      { found = 1; next }  # heading for this version
+          found && index($0, "## [") == 1 { exit }       # next version heading
+          found && /^\[.*\]: /      { exit }             # link reference block
+          found && index($0, "<!--") == 1 { exit }       # trailing comments
+          found                     { print }
         ' CHANGELOG.md \
           | sed -e '/./,$!d' -e :a -e '/^\n*$/{$d;N;};/\n$/ba' > RELEASE_NOTES.md
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b14f9ad..9da062d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,14 @@ While the major version is `0`, breaking changes may land in a minor release.
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-26
+
+Two breaking changes that tighten the public API: `Id` lookups return
+references, and ids can no longer be constructed by callers. Both are small,
+mechanical changes for callers. The `glad` dependency is gone, so the examples
+now build with one fewer third-party package and without a CMake policy
+override.
+
 ### Changed
 
 - **Breaking:** the `Id` lookups on `Animation` now return references rather
@@ -15,7 +23,12 @@ While the major version is `0`, breaking changes may land in a minor release.
   `channel(Id)` and `operator[](Id)`, in both the const and non-const forms.
   They never returned null: the underlying `unordered_map::at` throws
   `std::out_of_range` on a miss, so the pointer return only invited dead null
-  checks. Behavior on a miss is unchanged; callers replace `->` with `.` ([#52]).
+  checks. Behavior on a miss is unchanged; callers replace `->` with `.`
+  ([#52](https://github.com/Actualize-Interactive/anim/issues/52)).
+- The release workflow now refuses to publish a tag that is not an ancestor of
+  `main`. Squash-merging a pull request rewrites the commit, so a tag pushed to
+  the pre-merge branch tip builds and tests green while pointing at a commit
+  reachable only from the tag itself.
 
 ### Added
 
@@ -35,7 +48,8 @@ While the major version is `0`, breaking changes may land in a minor release.
   already bundles, and the handful of direct GL calls in
   `curve_visualization` are OpenGL 1.1 core, resolved by linking `OpenGL::GL`.
   This also removes the `CMAKE_POLICY_VERSION_MINIMUM` workaround that glad
-  0.1.36 required under CMake 4 ([#53]).
+  0.1.36 required under CMake 4
+  ([#53](https://github.com/Actualize-Interactive/anim/issues/53)).
 
 ### Fixed
 
@@ -50,9 +64,6 @@ While the major version is `0`, breaking changes may land in a minor release.
   directory, is now ignored rather than showing up as untracked noise in the
   repository root. Alternate build directories (`build-*/`) are ignored too.
 
-[#52]: https://github.com/Actualize-Interactive/anim/issues/52
-[#53]: https://github.com/Actualize-Interactive/anim/issues/53
-
 ## [0.2.0] - 2026-07-25
 
 First release prepared for the public repository. It contains two small
@@ -133,7 +144,8 @@ Bézier handle constraints, sampling helpers, and the Catch2 test suite.
      in 0.2.0. History was rewritten between the v0.1.1 and v0.1.2 tags, so the
      compare links below are more reliable than a commit-by-commit listing. -->
 
-[Unreleased]: https://github.com/Actualize-Interactive/anim/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/Actualize-Interactive/anim/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/Actualize-Interactive/anim/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/Actualize-Interactive/anim/compare/v0.1.2...v0.2.0
 [0.1.2]: https://github.com/Actualize-Interactive/anim/releases/tag/v0.1.2
 [0.1.1]: https://github.com/Actualize-Interactive/anim/releases/tag/v0.1.1
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 28059a4..4d7640e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.25)
-project(anim VERSION 0.2.0 LANGUAGES CXX)
+project(anim VERSION 0.3.0 LANGUAGES CXX)
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)