diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4dc4c1c..1eeb4b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Release version to build/publish (for example 0.6.3)
+        description: Release version to build/publish (for example 0.7.0)
         required: true
         type: string
       publish_nuget:
@@ -97,6 +97,17 @@ jobs:
           }
 
           $releaseTag = "v$releaseVersion"
+          $manifestVersionMatch = Select-String -LiteralPath 'Cargo.toml' -Pattern '^version\s*=\s*"([^"]+)"' |
+            Select-Object -First 1
+          if (-not $manifestVersionMatch) {
+            throw 'Unable to resolve the psign package version from Cargo.toml.'
+          }
+
+          $manifestVersion = $manifestVersionMatch.Matches[0].Groups[1].Value
+          if ($manifestVersion -ne $releaseVersion) {
+            throw "Release version $releaseVersion does not match Cargo.toml package version $manifestVersion."
+          }
+
           $isMasterBranch = $sourceBranch -eq 'master'
           $publishNuget = Parse-BoolOrDefault '${{ github.event.inputs.publish_nuget }}' $false
           $publishPsgallery = Parse-BoolOrDefault '${{ github.event.inputs.publish_psgallery }}' $false
diff --git a/Cargo.lock b/Cargo.lock
index 0a32003..a509c8e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2010,7 +2010,7 @@ dependencies = [
 
 [[package]]
 name = "psign"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -2047,7 +2047,7 @@ dependencies = [
 
 [[package]]
 name = "psign-authenticode-trust"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "authenticode",
@@ -2072,7 +2072,7 @@ dependencies = [
 
 [[package]]
 name = "psign-azure-kv-rest"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -2087,7 +2087,7 @@ dependencies = [
 
 [[package]]
 name = "psign-codesigning-rest"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -2102,7 +2102,7 @@ dependencies = [
 
 [[package]]
 name = "psign-digest-cli"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -2128,7 +2128,7 @@ dependencies = [
 
 [[package]]
 name = "psign-opc-sign"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "base64",
@@ -2139,7 +2139,7 @@ dependencies = [
 
 [[package]]
 name = "psign-portable-core"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "authenticode",
@@ -2163,7 +2163,7 @@ dependencies = [
 
 [[package]]
 name = "psign-portable-ffi"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "psign-portable-core",
@@ -2173,7 +2173,7 @@ dependencies = [
 
 [[package]]
 name = "psign-sip-digest"
-version = "0.6.3"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "authenticode",
diff --git a/Cargo.toml b/Cargo.toml
index 546a5ea..48540ca 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,7 +30,7 @@ repository = "https://github.com/Devolutions/psign"
 
 [package]
 name = "psign"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Rust port of the Windows SDK signtool.exe (Authenticode sign/verify/timestamp) with portable digest helpers."
 license.workspace = true
diff --git a/crates/psign-authenticode-trust/Cargo.toml b/crates/psign-authenticode-trust/Cargo.toml
index 0bffffd..ec213f9 100644
--- a/crates/psign-authenticode-trust/Cargo.toml
+++ b/crates/psign-authenticode-trust/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-authenticode-trust"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Portable Authenticode PKCS#7 trust verification (anchors, chain, EKU) using picky-rs"
 license.workspace = true
diff --git a/crates/psign-azure-kv-rest/Cargo.toml b/crates/psign-azure-kv-rest/Cargo.toml
index cec6863..de1c58d 100644
--- a/crates/psign-azure-kv-rest/Cargo.toml
+++ b/crates/psign-azure-kv-rest/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-azure-kv-rest"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Azure Key Vault certificate metadata + keys/sign REST (portable, blocking HTTP)"
 license.workspace = true
diff --git a/crates/psign-codesigning-rest/Cargo.toml b/crates/psign-codesigning-rest/Cargo.toml
index 410d45e..1999c26 100644
--- a/crates/psign-codesigning-rest/Cargo.toml
+++ b/crates/psign-codesigning-rest/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-codesigning-rest"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Azure Code Signing data-plane CertificateProfileOperations Sign LRO (portable, blocking HTTP)"
 license.workspace = true
diff --git a/crates/psign-digest-cli/Cargo.toml b/crates/psign-digest-cli/Cargo.toml
index 60de41c..f3bbd75 100644
--- a/crates/psign-digest-cli/Cargo.toml
+++ b/crates/psign-digest-cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-digest-cli"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Linux/macOS-friendly CLI over portable Authenticode SIP digests (psign-sip-digest)"
 license.workspace = true
diff --git a/crates/psign-opc-sign/Cargo.toml b/crates/psign-opc-sign/Cargo.toml
index c8115f7..1f495b3 100644
--- a/crates/psign-opc-sign/Cargo.toml
+++ b/crates/psign-opc-sign/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-opc-sign"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Portable OPC, VSIX, and NuGet package signing primitives"
 license.workspace = true
diff --git a/crates/psign-portable-core/Cargo.toml b/crates/psign-portable-core/Cargo.toml
index fd63bdf..21f551c 100644
--- a/crates/psign-portable-core/Cargo.toml
+++ b/crates/psign-portable-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-portable-core"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Reusable portable Authenticode signing and inspection APIs for psign"
 license.workspace = true
diff --git a/crates/psign-portable-ffi/Cargo.toml b/crates/psign-portable-ffi/Cargo.toml
index d00ce92..0100185 100644
--- a/crates/psign-portable-ffi/Cargo.toml
+++ b/crates/psign-portable-ffi/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-portable-ffi"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "C ABI shared library for psign portable Authenticode operations"
 license.workspace = true
diff --git a/crates/psign-sip-digest/Cargo.toml b/crates/psign-sip-digest/Cargo.toml
index e81ea99..b7caba7 100644
--- a/crates/psign-sip-digest/Cargo.toml
+++ b/crates/psign-sip-digest/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "psign-sip-digest"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Portable Authenticode SIP digest recomputation (PE, CAB, MSI, MSIX, scripts, …) without Win32"
 license.workspace = true