diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index cdb887c..ab45716 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -120,11 +120,12 @@ jobs:
         env:
           PACKAGES_GPG_KEY: ${{ secrets.PACKAGES_GPG_KEY }}
           PACKAGES_RSA_KEY: ${{ secrets.PACKAGES_RSA_KEY }}
+          TAG: ${{ inputs.tag }}
         run: |
           build() {
             docker buildx build -f release-tooling/package-repos.Dockerfile \
               --secret id=gpg,env=PACKAGES_GPG_KEY --secret id=rsa,env=PACKAGES_RSA_KEY \
-              --build-context packages=packages "$@" .
+              --build-context packages=packages --build-arg "EXPECTED_VERSION=$TAG" "$@" .
           }
           build --target checks --output type=local,dest=checks
           build --target site --output type=local,dest=site
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0b29134..8fadd51 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -32,7 +32,7 @@ jobs:
           else
             echo "code=true" >> "$GITHUB_OUTPUT"
           fi
-          if git diff --quiet "$base"...HEAD -- release-tooling Dockerfile .github/workflows/packages.yml; then
+          if git diff --quiet "$base"...HEAD -- release-tooling Dockerfile .dockerignore LICENSE DATA-LICENSES.md .github/workflows/packages.yml .github/workflows/test.yml; then
             echo "packaging=false" >> "$GITHUB_OUTPUT"
           else
             echo "packaging=true" >> "$GITHUB_OUTPUT"
diff --git a/README.md b/README.md
index e62d881..adc33c5 100644
--- a/README.md
+++ b/README.md
@@ -1205,10 +1205,11 @@ docker compose run --rm --user root --entrypoint chown test -R "$(id -u):$(id -g
 Every pull request runs `docker build .` against both the latest and the lowest
 supported Go, and must pass before it can be merged — unless it changes none of
 the files the build and its tests read, nor the workflow itself, in which case
-it's skipped. That build is the whole gate except the changelog check, which CI
-runs against the PR base, and the package-repository checks below: vet, complexity, the format check, the Go tests and the
-release tooling's tests. Run it locally before pushing. The lowest Go builds the
-`portable` stage, which skips the format check and the release tooling's tests:
+it's skipped. That build runs vet, complexity, the format check, the Go tests and the
+release tooling's tests; the rest of the gate is the changelog check, which CI runs
+against the PR base, and the package-repository checks below. Run it locally before
+pushing. The lowest Go builds the `portable` stage, which skips the format check and the
+release tooling's tests:
 
 ```sh
 docker build .                                                  # latest
@@ -1216,9 +1217,9 @@ docker build --build-arg GO_VERSION=1.22.12 --target portable . # lowest support
 GO_VERSION=1.22.12 docker compose run --rm test                 # the same tests, without the image build
 ```
 
-A change to `release-tooling/`, the `Dockerfile` or the Packages workflow also builds the
-apt, dnf and apk repositories from snapshot packages, signed with throwaway keys, and
-installs fejkdata from each:
+A change to `release-tooling/`, the `Dockerfile`, `.dockerignore`, the licence files or
+either workflow also builds the apt, dnf and apk repositories from snapshot packages,
+signs them with throwaway keys, and installs fejkdata from each:
 
 ```sh
 docker build -f release-tooling/package-repos.Dockerfile --target throwaway-keys --output /tmp/fejkdata-keys .
diff --git a/release-tooling/package-repos.Dockerfile b/release-tooling/package-repos.Dockerfile
index 57b5e02..7c3dacd 100644
--- a/release-tooling/package-repos.Dockerfile
+++ b/release-tooling/package-repos.Dockerfile
@@ -1,8 +1,10 @@
 # The apt, dnf and apk repositories GitHub Pages serves, signed, from the .deb, .rpm and
 # .apk files of the `packages` stage: a snapshot built from the source here, or a release's
 # when `--build-context packages=<dir>` replaces it. The checks target installs fejkdata
-# from each repository; the README's Development section shows the commands.
+# from each repository, and where EXPECTED_VERSION is set, checks it prints that tag; the
+# README's Development section shows the commands.
 ARG BASE_URL=https://larvit.github.io/fejkdata
+ARG EXPECTED_VERSION
 
 FROM goreleaser/goreleaser:v2.18.3 AS snapshot
 WORKDIR /w/src
@@ -73,24 +75,30 @@ COPY --from=deb-rpm /site /
 COPY --from=apk /site /
 
 FROM debian:trixie-20260918-slim AS check-deb
+ARG EXPECTED_VERSION
 COPY --from=site / /site
 RUN echo 'deb [signed-by=/site/fejkdata.asc] file:/site/deb stable main' > /etc/apt/sources.list.d/fejkdata.list \
 	&& apt-get update -o Dir::Etc::SourceList=/etc/apt/sources.list.d/fejkdata.list -o Dir::Etc::SourceParts=- \
 	&& apt-get install -y fejkdata \
-	&& fejkdata --version > /checked
+	&& fejkdata --version > /checked \
+	&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
 
 FROM fedora:43@sha256:a651ddf48ea28a06ed4e1e6519f51c9f47e7a5a138722ade87369b8fbb7e5b42 AS check-rpm
+ARG EXPECTED_VERSION
 COPY --from=site / /site
 RUN sed -e 's#^baseurl=.*#baseurl=file:///site/rpm#' -e 's#^gpgkey=.*#gpgkey=file:///site/fejkdata.asc#' \
 		/site/rpm/fejkdata.repo > /etc/yum.repos.d/fejkdata.repo \
 	&& dnf install -y --repo fejkdata fejkdata \
-	&& fejkdata --version > /checked
+	&& fejkdata --version > /checked \
+	&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
 
 FROM alpine:3.22.2 AS check-apk
+ARG EXPECTED_VERSION
 COPY --from=site / /site
 RUN cp /site/apk/fejkdata.rsa.pub /etc/apk/keys/ \
 	&& apk add --no-cache --repositories-file /dev/null -X /site/apk fejkdata \
-	&& fejkdata --version > /checked
+	&& fejkdata --version > /checked \
+	&& { [ -z "$EXPECTED_VERSION" ] || [ "$(cat /checked)" = "fejkdata $EXPECTED_VERSION" ]; }
 
 FROM scratch AS checks
 COPY --from=check-deb /checked /deb