diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0737b8f..818f3b7 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -61,10 +61,24 @@ jobs:
         id: meta
         run: |
           set -eu
+          manifest=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
+          version="$manifest"
+
+          # A tag that disagrees with Cargo.toml must never ship. The installer
+          # is named after the tag, but the binary reports env!("CARGO_PKG_VERSION")
+          # — so a mismatch leaves every installed copy seeing the release as
+          # newer than itself forever, reinstalling every few hours.
           case "$GITHUB_REF" in
-            refs/tags/v*) version="${GITHUB_REF#refs/tags/v}" ;;
-            *)            version=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2) ;;
+            refs/tags/v*)
+              version="${GITHUB_REF#refs/tags/v}"
+              if [ "$version" != "$manifest" ]; then
+                echo "tag v$version does not match Cargo.toml version $manifest" >&2
+                echo "bump the version in Cargo.toml and retag" >&2
+                exit 1
+              fi
+              ;;
           esac
+
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "version: $version"