diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e1f107..c6efb89 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,11 +38,44 @@ jobs:
         with:
           python-version: '3.12'
 
+      # A tag that disagrees with the version it claims to publish names the
+      # release one thing on GitHub and another on PyPI, and the number cannot
+      # be taken back. SCALCS and HJCFIT both have this gate; dcio did not, and
+      # 0.1.1 went out with dcio.__version__ still reading 0.1.0 -- a different
+      # drift, now fixed at the source by deriving it from the metadata.
+      - name: Tag matches the version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          python - <<'PY'
+          import os, pathlib, re
+          proj = re.search(r'^version = "([^"]+)"',
+                           pathlib.Path('pyproject.toml').read_text(), re.M).group(1)
+          tag = os.environ['GITHUB_REF'].removeprefix('refs/tags/v')
+          if proj != tag:
+              raise SystemExit(f'tag v{tag} does not match version {proj}')
+          print('tag and version agree:', proj)
+          PY
+
       - name: Build
         run: |
           python -m pip install --upgrade pip build twine
           python -m build
 
+      # The one thing a hardcoded __version__ could get wrong, asserted against
+      # the built artifact rather than the source tree.
+      - name: The wheel reports its own version
+        run: |
+          python -m venv /tmp/vcheck
+          /tmp/vcheck/bin/pip install --quiet dist/*.whl
+          /tmp/vcheck/bin/python - <<'PY'
+          import re, pathlib, dcio
+          proj = re.search(r'^version = "([^"]+)"',
+                           pathlib.Path('pyproject.toml').read_text(), re.M).group(1)
+          if dcio.__version__ != proj:
+              raise SystemExit(f'wheel reports {dcio.__version__}, pyproject says {proj}')
+          print('installed wheel reports', dcio.__version__)
+          PY
+
       # twine check catches the metadata problems that make a PyPI page render
       # badly or an upload fail outright -- a README that is not valid
       # reStructuredText or Markdown, a missing long_description content type.
diff --git a/dcio/__init__.py b/dcio/__init__.py
index a1fb59b..6f59958 100644
--- a/dcio/__init__.py
+++ b/dcio/__init__.py
@@ -14,5 +14,17 @@
 >>> print(rec)
 """
 
-__version__ = "0.1.0"
+# Taken from the installed package metadata rather than written here, so it
+# cannot drift from pyproject.toml. It already had: 0.1.1 was published with
+# pyproject saying 0.1.1 and this saying 0.1.0, so `pip install "dcio>=0.1.1"`
+# succeeded and `dcio.__version__` then reported 0.1.0.
+try:
+    from importlib.metadata import PackageNotFoundError, version as _version
+    try:
+        __version__ = _version("dcio")
+    except PackageNotFoundError:        # a source tree that was never installed
+        __version__ = "0.0.0+unknown"
+    del _version, PackageNotFoundError
+except ImportError:                     # pragma: no cover
+    __version__ = "0.0.0+unknown"
 __author__ = "Remis Lape"
diff --git a/pyproject.toml b/pyproject.toml
index 6d5374c..bb075ad 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "dcio"
-version = "0.1.1"
+version = "0.1.2"
 description = "I/O and record layer for electrophysiology file formats used by the DCPROGS suite"
 readme = "README.md"
 license = "MIT"