diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 25da66a..7e8f3e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,36 @@ jobs:
 
       - run: npm run bundle
 
+      # Release PRs only: the committed bundle is what plugin users run, so it
+      # must match a fresh build. Elsewhere it is expected to lag behind main
+      # between releases, because it is only regenerated on the release PR.
+      # release.yml regenerates it only when release-please updates the PR, so
+      # a bundle made stale by later non-release commits on main (e.g.
+      # dependency bumps) has to be regenerated by hand; the steps are printed
+      # below when the check fails.
+      - name: Check that the committed bundle is up to date
+        if: github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--')
+        env:
+          BRANCH: ${{ github.head_ref }}
+        run: |
+          if ! git diff --exit-code --stat plugin/scripts/bundle.js; then
+            echo "The committed bundle differs from a fresh build of this PR merged with main."
+            echo "Regenerate it on the release PR branch:"
+            echo ""
+            echo "  git fetch origin"
+            echo "  git switch -C ${BRANCH} origin/${BRANCH}"
+            echo "  git merge origin/main"
+            echo "  npm ci"
+            echo "  npm run bundle"
+            echo "  git add plugin/scripts/bundle.js"
+            echo "  git commit --no-verify -m \"chore: regenerate bundle.js for release\""
+            echo "  git push origin ${BRANCH}"
+            echo ""
+            echo "--no-verify is needed because the pre-commit hook blocks bundle commits outside the release workflow."
+            echo "::error file=plugin/scripts/bundle.js::The committed bundle is stale. Regenerate it on the release PR branch; see the steps in this log."
+            exit 1
+          fi
+
       # Run the bundle on the exact minimum Node allowed by package.json
       # "engines". Copy plugin/ out of the checkout first, as the plugin cache
       # does, so neither node_modules nor the root package.json is visible.