diff --git a/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.test.mjs b/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.test.mjs
index 9ab2e0542..67cddeca2 100644
--- a/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.test.mjs
+++ b/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.test.mjs
@@ -3,7 +3,7 @@ import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promis
 import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
-import { parsePackageVersion, parseSdkRequirements } from './generate-terraform-docs.ts';
+import { checkReportedVersion, parsePackageVersion, parseSdkRequirements } from './generate-terraform-docs.ts';
 import { latestStableVersion } from './sources.ts';
 import { SourceTree } from './source-tree.ts';
 import {
@@ -294,6 +294,26 @@ require (
   assert.throws(() => parsePackageVersion('package internal', 'provider'), /provider: internal\/version.go/);
 });
 
+test('checkReportedVersion tolerates only a patch mismatch with the tag', () => {
+  assert.equal(checkReportedVersion('provider', '5.28.1', '5.28.1'), undefined);
+  assert.equal(checkReportedVersion('sdk', 'v7.13.1', '7.13.1'), undefined);
+  assert.match(
+    checkReportedVersion('provider', '5.28.1', '5.28.0'),
+    /^provider: v5\.28\.1 checkout reports version 5\.28\.0/,
+  );
+  assert.match(checkReportedVersion('sdk', 'v7.13.1', '7.13.0'), /^sdk: v7\.13\.1 checkout reports version 7\.13\.0/);
+  assert.throws(
+    () => checkReportedVersion('provider', '5.29.0', '5.28.0'),
+    /v5\.29\.0 checkout reports version 5\.28\.0/,
+  );
+  assert.throws(() => checkReportedVersion('provider', '6.0.0', '5.28.0'), /checkout reports version/);
+  assert.throws(() => checkReportedVersion('provider', '5.28.1', '5.28.1-beta.1'), /checkout reports version/);
+  assert.throws(
+    () => checkReportedVersion('sdk', 'v7.12.1-0.20261001120000-0123456789ab', '7.12.0'),
+    /checkout reports version/,
+  );
+});
+
 test('SourceTree confines reads to the checkout and never follows symbolic links', async (t) => {
   const base = await mkdtemp(path.join(os.tmpdir(), 'source-tree-'));
   t.after(() => rm(base, { recursive: true, force: true }));
diff --git a/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.ts b/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.ts
index 1690ce71b..b38e6119c 100644
--- a/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.ts
+++ b/packages/cloudflare-terraform-docs/scripts/generate-terraform-docs.ts
@@ -16,8 +16,8 @@ import process from 'node:process';
 import { pathToFileURL } from 'node:url';
 import { parseArgs } from 'node:util';
 import { generatedTerraformDocsSchema } from './schema.ts';
-import { cloneRelease, resolveLatestProviderVersion } from './sources.ts';
 import { SourceTree } from './source-tree.ts';
+import { cloneRelease, resolveLatestProviderVersion } from './sources.ts';
 import {
   buildTerraformDocs,
   declarationFiles,
@@ -57,6 +57,25 @@ export function parsePackageVersion(versionGo: string, label: string): string {
   return version;
 }
 
+/**
+ * Checks the version a checkout's `internal/version.go` reports against the tag it was cloned from.
+ * Release-please does not always bump that file for patch releases (provider v5.28.1 and
+ * cloudflare-go v7.13.1 both report x.y.0), so a patch-only mismatch returns a warning; any other
+ * mismatch throws.
+ */
+export function checkReportedVersion(label: string, tag: string, reported: string): string | undefined {
+  const version = tag.replace(/^v/, '');
+  if (reported === version) {
+    return undefined;
+  }
+  const minor = (value: string) => value.match(/^(\d+\.\d+)\.\d+$/)?.[1];
+  const tagMinor = minor(version);
+  if (tagMinor && tagMinor === minor(reported)) {
+    return `${label}: v${version} checkout reports version ${reported}; continuing with the tag`;
+  }
+  throw new Error(`${label}: v${version} checkout reports version ${reported}`);
+}
+
 async function collectServices(provider: SourceTree): Promise<ServiceSource[]> {
   const files = await provider.listFiles('internal/services', (file) =>
     /^internal\/services\/\w+\/(?:resource|data_source|list_data_source)\.go$/.test(file),
@@ -124,8 +143,9 @@ async function main() {
     await cloneRelease('terraform-provider-cloudflare', `v${version}`, path.join(cache, 'provider')),
   );
   const providerVersion = parsePackageVersion(await provider.requireText('internal/version.go'), 'provider');
-  if (providerVersion !== version) {
-    throw new Error(`provider: v${version} checkout reports version ${providerVersion}`);
+  const providerWarning = checkReportedVersion('provider', version, providerVersion);
+  if (providerWarning) {
+    console.warn(`warning: ${providerWarning}`);
   }
   const services = await collectServices(provider);
   const requirements = parseSdkRequirements(await provider.requireText('go.mod'));
@@ -144,8 +164,9 @@ async function main() {
       await cloneRelease('cloudflare-go', required, path.join(cache, path.posix.basename(module))),
     );
     const sdkVersion = parsePackageVersion(await sdk.requireText('internal/version.go'), module);
-    if (`v${sdkVersion}` !== required) {
-      throw new Error(`${module}: ${required} checkout reports version ${sdkVersion}`);
+    const sdkWarning = checkReportedVersion(module, required, sdkVersion);
+    if (sdkWarning) {
+      console.warn(`warning: ${sdkWarning}`);
     }
     const commit = await sdk.gitCommit();
     sdks.push({ module, version: required, ...(commit ? { commit } : {}) });