diff --git a/scripts/release.sh b/scripts/release.sh
index fb68d33..3ac3a51 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -10,9 +10,10 @@
 # test files) and the plan is printed, but nothing is committed, tagged or
 # published. --apply performs the release:
 #
-#   1. bump package.json, commit `chore(release): <version>`, tag `v<version>`
+#   1. require package.json to already carry <version> (bumped via a PR),
+#      tag `v<version>` on that commit
 #   2. `npm publish --access public` of the exact packed tarball
-#   3. push the commit + tag
+#   3. push the tag
 #   4. install smoke into a throwaway prefix from the registry and run
 #      `secrets --version` and `secrets exec` on a canary bundle with
 #      SECRETS_HOME pointed at a temp dir — the release is not done until the
@@ -91,13 +92,12 @@ if [ -n "${NPM_TOKEN:-}" ]; then
   trap 'rm -f "$TARBALL" "$NPM_CONFIG_USERCONFIG"' EXIT
 fi
 
-npm version "$VERSION" --no-git-tag-version >/dev/null
-git add package.json
-git commit -q -m "chore(release): $VERSION"
+# The version bump lands through a reviewed PR like every other change; this
+# script only tags the commit that already carries it and publishes that tree.
+[ "$(node -p "require('./package.json').version")" = "$VERSION" ] || die "package.json is not at $VERSION — bump it in a PR first"
 git tag -a "v$VERSION" -m "$PKG $VERSION"
-rm -f "$TARBALL"; TARBALL="$(npm pack --silent 2>/dev/null)"
 npm publish "$TARBALL" --access public
-git push -q origin "$DEFAULT_BRANCH" "v$VERSION"
+git push -q origin "v$VERSION"
 green "  published $PKG@$VERSION"
 
 # --- install smoke -----------------------------------------------------------