diff --git a/continuous-delivery/publish.yml b/continuous-delivery/publish.yml
index e41675a8..5f082586 100644
--- a/continuous-delivery/publish.yml
+++ b/continuous-delivery/publish.yml
@@ -10,7 +10,7 @@ phases:
     commands:
       - cd $CODEBUILD_SRC_DIR/aws-iot-device-sdk-js-v2
       - aws secretsmanager get-secret-value --secret-id prod/npm-registry/.npmrc --region us-east-1 | jq -r .SecretString > .npmrc
-      - sed --in-place -E "s/\"version\":: \".+\"/\"version\":: \"${PKG_VERSION}\"/" package.json
+      - ./update-version.sh
       - npm install
       - npm pack
       - npm --userconfig ./.npmrc publish aws-iot-device-sdk-v2*.tgz          
diff --git a/continuous-delivery/update-version.sh b/continuous-delivery/update-version.sh
new file mode 100755
index 00000000..f5b3e2d6
--- /dev/null
+++ b/continuous-delivery/update-version.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -ex
+
+# force a failure if there's no tag
+git describe --tags
+# now get the tag
+CURRENT_TAG=$(git describe --tags | cut -f2 -dv)
+# convert v0.2.12-2-g50254a9 to 0.2.12
+CURRENT_TAG_VERSION=$(git describe --tags | cut -f1 -d'-' | cut -f2 -dv)
+# if there's a hash on the tag, then this is not a release tagged commit
+if [ "$CURRENT_TAG" != "$CURRENT_TAG_VERSION" ]; then
+    echo "Current tag version is not a release tag, cut a new release if you want to publish."
+    exit 1
+fi
+
+sed --in-place -E "s/\"version\": \".+\"/\"version\": \"${PKG_VERSION}\"/" package.json
+
+exit 0