diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7322e65..ee221df 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,6 +40,10 @@ jobs:
             echo 'source_tag must be a strict stable or preview.N/alpha.N/beta.N/rc.N tag' >&2
             exit 1
           fi
+          if [[ "$CYC_SOURCE_TAG" != *-* ]]; then
+            echo 'stable tags must be published only by the protected ga.yml workflow' >&2
+            exit 1
+          fi
           # actions/checkout first fetches the annotated tag, then force-updates
           # refs/tags/<tag> to the checked-out commit for detached HEAD. Verify
           # the immutable remote tag through a separate local namespace instead
diff --git a/scripts/Test-VersionConsistency.ps1 b/scripts/Test-VersionConsistency.ps1
index cc2841c..579217e 100644
--- a/scripts/Test-VersionConsistency.ps1
+++ b/scripts/Test-VersionConsistency.ps1
@@ -209,6 +209,10 @@ function Assert-CycReleaseWorkflowIdentity {
     if (-not $workflow.Contains($strictStableTagGate)) {
         throw 'Release workflow source-tag validation is not aligned with the strict prerelease/stable channel contract.'
     }
+    if (-not $workflow.Contains('if [[ "$CYC_SOURCE_TAG" != *-* ]]; then') -or
+        $workflow -notmatch "stable tags must be published only by the protected ga\.yml workflow") {
+        throw 'The ordinary release publisher must reject stable tags and defer them to the protected GA workflow.'
+    }
 
     $releaseJob = [System.Text.RegularExpressions.Regex]::Match(
         $workflow,