diff --git a/.claims-latest.json b/.claims-latest.json
new file mode 100644
index 0000000..fc87c33
--- /dev/null
+++ b/.claims-latest.json
@@ -0,0 +1,5 @@
+{
+  "claims": [
+    {"id": "action pins in the README equal the newest release", "file": "README.md", "regex": "node24-ready@v([0-9.]+)", "expect": {"latest_tag": "https://github.com/cosmichackerx/node24-ready"}}
+  ]
+}
diff --git a/.claims-release.json b/.claims-release.json
new file mode 100644
index 0000000..18b6440
--- /dev/null
+++ b/.claims-release.json
@@ -0,0 +1,6 @@
+{
+  "claims": [
+    {"id": "action pins in the README equal the tag being released", "file": "README.md", "regex": "node24-ready@v([0-9.]+)", "expect": {"env": "RELEASE_TAG", "regex": "^v([0-9.]+)$"}},
+    {"id": "package version equals the tag being released", "file": "package.json", "regex": "\"version\": \"([0-9.]+)\"", "expect": {"env": "RELEASE_TAG", "regex": "^v([0-9.]+)$"}}
+  ]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6bd3d3d..edfe1b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      - uses: cosmichackerx/claims-check@v0.1.0
+      - uses: cosmichackerx/claims-check@v0.2.0
 
   bundle:
     name: bundle is up to date
diff --git a/.github/workflows/claims-latest.yml b/.github/workflows/claims-latest.yml
new file mode 100644
index 0000000..841d85f
--- /dev/null
+++ b/.github/workflows/claims-latest.yml
@@ -0,0 +1,22 @@
+# Weekly: the README must pin the newest release of this repository (a stale pin tells readers to install an old version).
+name: README pins vs newest tag
+
+on:
+  schedule:
+    - cron: "17 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pins:
+    name: README pins equal the newest tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: cosmichackerx/claims-check@v0.2.0
+        with:
+          config: .claims-latest.json
diff --git a/.github/workflows/release-gate.yml b/.github/workflows/release-gate.yml
new file mode 100644
index 0000000..9656648
--- /dev/null
+++ b/.github/workflows/release-gate.yml
@@ -0,0 +1,42 @@
+# Pre-release claims gate: the README, the package version and the tag being released must agree.
+# Run it by hand BEFORE tagging (Actions > Release gate > Run workflow, tag = v1.2.3), and it runs again on the tag.
+name: Release gate
+
+on:
+  workflow_call:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag you are about to create, for example v1.2.3 "
+        required: true
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  claims:
+    name: claims-check against the tag
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Tag looks like a version
+        run: |
+          case "$RELEASE_TAG" in v[0-9]*) ;; *) echo "RELEASE_TAG=$RELEASE_TAG is not a version tag (use v1.2.3 in the tag input)"; exit 1;; esac
+      - name: README numbers and pins hold
+        uses: cosmichackerx/claims-check@v0.2.0
+      - name: README pins and package version equal the tag being released
+        uses: cosmichackerx/claims-check@v0.2.0
+        with:
+          config: .claims-release.json
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 309ff64..73c00a5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -10,3 +10,4 @@ npm run bundle    # regenerate action/index.mjs; commit it with your change (CI
 * New findings need a rule id in `src/types.ts`, an entry in the README table and a test.
 * If you report a false positive or false negative, include the `uses:` line and the `runs.using` you see in that action's `action.yml`.
 * Keep the action free of other actions (`test/action-metadata.test.ts` enforces it).
+* Releasing: bump the version and the README pins in a PR, merge when green, then run **Actions > Release gate** with the new tag (for example `v1.2.3`) *before* you create the tag. The same check runs again on the tag, and a weekly job (`claims-latest.yml`) fails when the README pins an older release than the newest tag.