diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0900aa0..9e83c51 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,6 +58,21 @@ jobs:
         with:
           persist-credentials: false
 
+      # The tag names the image; Cargo.toml's version is what the binary reports from
+      # --version. Nothing tied the two together, and 0.6.5 shipped reporting 0.6.4.
+      # A prerelease tag (v0.6.6-rc1) is a candidate for its core version: compare that.
+      - name: Check the tag matches Cargo.toml
+        if: github.event_name == 'push'
+        run: |
+          set -eu
+          tag="${GITHUB_REF_NAME#v}"
+          cargo=$(awk '/^\[/{p=($0=="[package]")} p && /^version *=/{gsub(/.*= *"|".*/,""); print; exit}' Cargo.toml)
+          if [ "${tag%%-*}" != "$cargo" ]; then
+            echo "::error::tag ${GITHUB_REF_NAME}, but Cargo.toml version is ${cargo:-<none>}; bump Cargo.toml and Cargo.lock before tagging"
+            exit 1
+          fi
+          echo "tag ${GITHUB_REF_NAME} matches Cargo.toml ${cargo}"
+
       - name: Set up Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
diff --git a/Cargo.lock b/Cargo.lock
index f29aee3..112bcb6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -176,7 +176,7 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cache-aware-router"
-version = "0.6.4"
+version = "0.6.6"
 dependencies = [
  "arc-swap",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index c3417b5..e0ab331 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cache-aware-router"
-version = "0.6.4"
+version = "0.6.6"
 edition = "2021"
 rust-version = "1.88"
 description = "Cache-aware router for LLM inference backends: routes requests to the replica that already holds the longest matching prompt prefix, while keeping load balanced."