diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 15a2848..a3349aa 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -11,9 +11,36 @@ on:
     tags:
       - v*.*
 jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    name: Check Tag Matches Manifests
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Compare the tag with both manifests
+        run: |
+          # The committed manifests carry the version and ship as is, so a tag
+          # build has to match both before either platform can be released.
+          if [[ $GITHUB_REF != refs/tags/v* ]]; then
+            exit 0
+          fi
+
+          TAG_VERSION=${GITHUB_REF#refs/tags/v}
+          STATUS=0
+          for MANIFEST in src/manifest-chrome.json src/manifest-firefox.json; do
+            MANIFEST_VERSION=$(jq -r .version "$MANIFEST")
+            if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then
+              echo "::error::Tag v$TAG_VERSION does not match $MANIFEST version $MANIFEST_VERSION. Bump both manifests on master, then tag that commit."
+              STATUS=1
+            fi
+          done
+          exit $STATUS
+
   build:
     runs-on: ubuntu-latest
     name: Build and Generate Artifact
+    needs: check-version
     permissions:
       id-token: write
       contents: write
@@ -26,16 +53,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Prepare manifest.json
-        run: |
-          if [[ $GITHUB_REF == refs/tags/v* ]]; then
-            export SCREENLY_CE_VERSION=${GITHUB_REF#refs/tags/v}
-          else
-            export SCREENLY_CE_VERSION="0.0.0"
-          fi
-
-          cat src/manifest-${{ matrix.platform }}.json \
-              | jq --arg version "$SCREENLY_CE_VERSION" '.version = $version' \
-              > src/manifest.json
+        run: cp src/manifest-${{ matrix.platform }}.json src/manifest.json
 
       - name: Build Docker images
         run: |
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 8490cac..965726b 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -23,16 +23,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Prepare manifest.json
-        run: |
-          if [[ $GITHUB_REF == refs/tags/v* ]]; then
-            export SCREENLY_CE_VERSION=${GITHUB_REF#refs/tags/v}
-          else
-            export SCREENLY_CE_VERSION="0.0.0"
-          fi
-
-          cat src/manifest-${{ matrix.platform }}.json \
-              | jq --arg version "$SCREENLY_CE_VERSION" '.version = $version' \
-              > src/manifest.json
+        run: cp src/manifest-${{ matrix.platform }}.json src/manifest.json
 
       - name: Build Docker images
         run: |
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1d46fcc..7818a03 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -44,11 +44,10 @@ which is what `build.yaml` triggers on.
 both on `master` first, then tag that commit, and keep the tag and the manifests
 equal.
 
-Nothing checks that yet. `build.yaml` and `test.yaml` still derive `.version`
-from the git ref and write it over the manifest on the way into the build, which
-is how the committed number came to differ from every released one. Replacing
-that with a check is a follow-up; until it lands, the tag and the manifests
-agreeing is a convention rather than a guarantee.
+`build.yaml` enforces this: on a tag, a check job compares the tag with both
+manifests and the builds only start once it passes, so a mismatch stops the
+release for both platforms. The manifests are copied into the build unchanged,
+so what you commit is what ships.
 
 `package.json` is the build tooling's own manifest (`sce-webpack`, `private`),
 not the extension's. Its version is unrelated and is not bumped for a release.