diff --git a/build.gradle.kts b/build.gradle.kts
index 68d26f7..7588aa1 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -11,7 +11,8 @@ plugins {
 group = "de.hoennig"
 // bump at least the patch version for every deployment — and only then, not per commit —
 // so the UI footer (BuildProperties), --version and the release notes identify what is
-// actually running; a deployment bundles whatever was committed since the last one
+// actually running; a deployment bundles whatever was committed since the last one.
+// ReleaseVersionConsistencyTest fails the build if this and the top releases.html entry disagree.
 version = "1.1.0"
 
 java {
diff --git a/src/test/kotlin/de/hoennig/werkator/ReleaseVersionConsistencyTest.kt b/src/test/kotlin/de/hoennig/werkator/ReleaseVersionConsistencyTest.kt
new file mode 100644
index 0000000..8e2494e
--- /dev/null
+++ b/src/test/kotlin/de/hoennig/werkator/ReleaseVersionConsistencyTest.kt
@@ -0,0 +1,29 @@
+package de.hoennig.werkator
+
+import io.kotest.core.spec.style.FunSpec
+import io.kotest.matchers.shouldBe
+import io.kotest.matchers.shouldNotBe
+import java.io.File
+
+/**
+ * A version bump is easy to forget on a deployment (it happened twice on 2026-09-03) — this
+ * fails the build so a deployment can never carry an artifact whose footer/`--version` claims
+ * a release that has no notes, or notes for a release nothing was actually built for.
+ */
+class ReleaseVersionConsistencyTest : FunSpec() {
+    init {
+        test("the top release-notes entry names the current project version") {
+            val buildGradle = File("build.gradle.kts").readText()
+            val versionMatch = Regex("""^version = "([^"]+)"""", RegexOption.MULTILINE).find(buildGradle)
+            versionMatch shouldNotBe null
+            val projectVersion = versionMatch!!.groupValues[1]
+
+            val releaseNotes = File("src/main/resources/templates/releases.html").readText()
+            val topHeadingMatch = Regex("""<h2>v([0-9.]+)\s""").find(releaseNotes)
+            topHeadingMatch shouldNotBe null
+            val topReleasedVersion = topHeadingMatch!!.groupValues[1]
+
+            topReleasedVersion shouldBe projectVersion
+        }
+    }
+}