diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 33588a7..a949fd3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,8 @@ jobs:
       stable: ${{ steps.meta.outputs.stable }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
@@ -54,6 +56,15 @@ jobs:
           with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf8") as output:
               output.write(f"stable={stable}\n")
           EOF
+      - name: Verify the release commit is on ${{ github.event.repository.default_branch }}
+        if: github.ref_type == 'tag' && steps.meta.outputs.stable == 'true'
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/$DEFAULT_BRANCH"; then
+            echo "::error::$GITHUB_REF_NAME is not on $DEFAULT_BRANCH. Tag a stable release on a commit that was merged into $DEFAULT_BRANCH."
+            exit 1
+          fi
       - name: Install dependencies
         run: pip install tox build
       - name: Lint