diff --git a/.github/workflows/release-check-version-tag b/.github/workflows/release-check-version-tag
new file mode 100755
index 0000000..be3b943
--- /dev/null
+++ b/.github/workflows/release-check-version-tag
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# We call setuptools.setup() here as we may rely on setuptools to interpret
+# a dynamic version field. (Reading pyproject.toml is not enough in that case.)
+expected_git_tag="v$(python -c 'from setuptools import setup; setup()' --version)"
+actual_git_tag="$(git describe)"
+
+if [[ "$expected_git_tag" == "$actual_git_tag" ]]; then
+  echo "OK: Python package version $expected_git_tag matches git tag"
+  exit 0
+else
+  echo "ERROR: Python package version $expected_git_tag does NOT match git tag $actual_git_tag"
+  exit 1
+fi
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 09ca21f..fed64c0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+      - name: Check git tag vs package version
+        run: .github/workflows/release-check-version-tag
       - name: Build package
         run: python3 -m pip install --upgrade build && python3 -m build
       - name: Upload dist