diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 33e2d08..662b69b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,6 +24,17 @@ jobs:
           node-version: 24
           package-manager-cache: false
 
+      - name: Verify tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match package.json version ${PKG_VERSION}."
+            echo "::error::Create a 'chore: release v${PKG_VERSION}' style commit that bumps package.json, then tag that commit."
+            exit 1
+          fi
+          echo "Tag ${GITHUB_REF_NAME} matches package.json version ${PKG_VERSION}."
+
       - name: Install dependencies
         run: npm ci
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e58ca55..1869105 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 2.2.3 - 2026-08-22
 
 - Detect headless Chrome. The list carried `chromeheadless`, which is the Karma
   launcher label; Chrome itself reports `HeadlessChrome/<version>`.
diff --git a/package.json b/package.json
index ff6c48f..625e3ac 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "express-useragent",
   "description": "JS Library & ExpressJS user-agent middleware exposing",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "homepage": "https://github.com/biggora/express-useragent/",
   "repository": {
     "type": "git",