diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 06fc4ee..29bbd90 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,3 +27,17 @@ jobs:
       - run: cargo fmt --all --check
       - run: cargo clippy --all-targets -- -D warnings
       - run: cargo test
+
+      # This commit's agent against the latest released hub, through the hub
+      # repository's end-to-end script: the reported fields are checked where
+      # the hub and the themes read them, not only where they are serialized.
+      - uses: actions/checkout@v7
+        with:
+          repository: monitor-probe/monitor
+          path: hub
+          sparse-checkout: scripts
+      - run: cargo build
+      - run: |
+          curl -fsSL -o monitor-hub https://github.com/monitor-probe/monitor/releases/latest/download/monitor-hub-x86_64-unknown-linux-musl
+          chmod +x monitor-hub
+      - run: hub/scripts/e2e.sh ./monitor-hub target/debug/monitor-agent
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f47d0ac..4225e06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,12 @@ jobs:
         target: [x86_64-unknown-linux-musl, aarch64-unknown-linux-musl]
     steps:
       - uses: actions/checkout@v7
+      # A v* tag can be neither moved nor deleted, so one that disagrees with the
+      # version the agent reports stops here, before anything is published.
+      - if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          V=v$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml)
+          [ "$GITHUB_REF_NAME" = "$V" ] || { echo "::error::tag $GITHUB_REF_NAME, Cargo.toml $V"; exit 1; }
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}