diff --git a/apps/macos/Scripts/manual-release-evidence-template.sh b/apps/macos/Scripts/manual-release-evidence-template.sh
index a127fdd..2bfe37b 100755
--- a/apps/macos/Scripts/manual-release-evidence-template.sh
+++ b/apps/macos/Scripts/manual-release-evidence-template.sh
@@ -86,6 +86,14 @@ APP_BUNDLE_ID=$(/usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$INFO_PL
 APP_VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$INFO_PLIST")
 APP_BUILD=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$INFO_PLIST")
 APP_EXECUTABLE_SHA256="$(shasum -a 256 "$EXECUTABLE_PATH" | awk '{print $1}')"
+EXPECTED_RELEASE_TAG="v$APP_VERSION"
+
+if [[ "$RELEASE_TAG" != "$EXPECTED_RELEASE_TAG" ]]; then
+    echo "ERROR: RELEASE_TAG does not match mounted app version" >&2
+    echo "Release tag:  $RELEASE_TAG" >&2
+    echo "Expected tag: $EXPECTED_RELEASE_TAG" >&2
+    exit 2
+fi
 
 cat <<EOF
 Release tag: $RELEASE_TAG
diff --git a/apps/macos/Tests/PointerDesignerTests/IdentityTests.swift b/apps/macos/Tests/PointerDesignerTests/IdentityTests.swift
index 8ab6e50..0a9d83d 100644
--- a/apps/macos/Tests/PointerDesignerTests/IdentityTests.swift
+++ b/apps/macos/Tests/PointerDesignerTests/IdentityTests.swift
@@ -812,6 +812,8 @@ final class IdentityTests: XCTestCase {
         XCTAssertTrue(template.contains("ERROR: RELEASE_TAG is required for artifact-bound manual release evidence"))
         XCTAssertTrue(template.contains("make manual-release-evidence-template RELEASE_TAG="))
         XCTAssertTrue(template.contains("v<app-version>"))
+        XCTAssertTrue(template.contains("EXPECTED_RELEASE_TAG=\"v$APP_VERSION\""))
+        XCTAssertTrue(template.contains("ERROR: RELEASE_TAG does not match mounted app version"))
         XCTAssertTrue(template.contains("Commit:"))
         XCTAssertTrue(template.contains("DMG SHA-256:"))
         XCTAssertTrue(template.contains("App bundle ID:"))