diff --git a/CHANGELOG.d/2.28.0-release-identity.md b/CHANGELOG.d/2.28.0-release-identity.md
new file mode 100644
index 000000000..78ae4ceae
--- /dev/null
+++ b/CHANGELOG.d/2.28.0-release-identity.md
@@ -0,0 +1,4 @@
+## Fixed
+
+- Synchronized the LineageWeave runtime `__version__` with the Python and frontend package metadata at `2.28.0`.
+- Added `tests/test_package_version.py` so release identity drift fails before a protected release can be treated as reproducible provenance.
diff --git a/lineageweave/__init__.py b/lineageweave/__init__.py
index 45c371fa7..de72e74f2 100644
--- a/lineageweave/__init__.py
+++ b/lineageweave/__init__.py
@@ -130,4 +130,4 @@
     "serialize_lineage_analysis_result",
 ]
 
-__version__ = "2.20.0"
+__version__ = "2.28.0"
diff --git a/tests/test_package_version.py b/tests/test_package_version.py
new file mode 100644
index 000000000..cb85f136e
--- /dev/null
+++ b/tests/test_package_version.py
@@ -0,0 +1,20 @@
+"""Release identity stays consistent across Python and frontend artifacts."""
+
+from __future__ import annotations
+
+import json
+import tomllib
+from pathlib import Path
+
+from lineageweave import __version__
+
+
+def test_release_versions_are_synchronized() -> None:
+    """Runtime provenance must use the same version as shipped package metadata."""
+    repository_root = Path(__file__).resolve().parents[1]
+    project = tomllib.loads((repository_root / "pyproject.toml").read_text(encoding="utf-8"))
+    frontend = json.loads(
+        (repository_root / "frontend" / "package.json").read_text(encoding="utf-8")
+    )
+
+    assert __version__ == project["project"]["version"] == frontend["version"]