diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 538a345..7fdd0a4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Verify tag matches package.json version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          pkg=$(node -p "require('./package.json').version")
+          if [ "v$pkg" != "$TAG" ]; then
+            echo "::error::Tag $TAG does not match package.json version $pkg. Tag the version-bump commit (git push --follow-tags), and delete the bad tag."
+            exit 1
+          fi
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with: