diff --git a/.github/workflows/check-version.sh b/.github/workflows/check-version.sh
new file mode 100755
index 0000000..a215757
--- /dev/null
+++ b/.github/workflows/check-version.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -ex
+
+TAG="${GITHUB_REF_NAME:-${GITHUB_REF#refs/tags/}}"
+if [ -z "$TAG" ] || [ "$TAG" = "$GITHUB_REF" ]; then
+  echo "Unable to determine tag from GitHub Actions environment"
+  exit 1
+fi
+FILE_VERSION=$(sed -nE 's/var Version = "(.*)"/\1/p' cmd/version.go)
+
+if [ "$TAG" != "v$FILE_VERSION" ]; then
+  echo "Version mismatch: tag is $TAG but version.go has $FILE_VERSION"
+  exit 1
+fi
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b0e7501..873b8fa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Confirm tag and code versions match
+        run: |
+          .github/workflows/check-version.sh
+
       - uses: cli/gh-extension-precompile@v2
         with:
           generate_attestations: true
diff --git a/cmd/version.go b/cmd/version.go
index a1cf6a4..fda328f 100644
--- a/cmd/version.go
+++ b/cmd/version.go
@@ -8,7 +8,7 @@ import (
 )
 
 // Version of the CLI app.
-var Version = "0.1.0"
+var Version = "0.0.10"
 
 // The command prints out the version of the CLI app.
 func init() {