diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b24398d..6426936 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,10 @@ name: release
 # tag IS the package, and install.sh downloads exactly that.
 on:
   push:
-    tags: ["[0-9]*.[0-9]*.[0-9]*"]
+    # Every tag, not a shape filter (rig's precedent): a tag that mismatches
+    # VERSION — a habitual v0.7.0, a typo — must fail the assert LOUDLY
+    # below, not be silently skipped by a pattern that didn't match.
+    tags: ["**"]
 
 permissions:
   contents: write # gh release create