diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 4479dda..ed79df6 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -19,7 +19,12 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
+
+      - name: Verify package version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: test "$(node -p "require('./package.json').version")" = "$RELEASE_TAG"
 
       - name: Create build
         run: npm run build
diff --git a/package-lock.json b/package-lock.json
index c44d09a..330da7a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@staffbase/staffbase-plugin-sdk",
-  "version": "1.3.8",
+  "version": "1.3.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@staffbase/staffbase-plugin-sdk",
-      "version": "1.3.8",
+      "version": "1.3.9",
       "license": "ISC",
       "dependencies": {
         "jsonwebtoken": "^9.0.0",
diff --git a/package.json b/package.json
index 1bccedf..fddbf3a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@staffbase/staffbase-plugin-sdk",
-  "version": "1.3.8",
+  "version": "1.3.9",
   "description": "Staffbase Plugin SDK for Javascript / Node.js",
   "main": "./dist/index.js",
   "scripts": {