diff --git a/.build/Get-PlatformVersion.ps1 b/.build/Get-PlatformVersion.ps1
index d7c9db4..aa96342 100644
--- a/.build/Get-PlatformVersion.ps1
+++ b/.build/Get-PlatformVersion.ps1
@@ -2,6 +2,21 @@
 [CmdletBinding()]
 param([string]$WorkspaceRoot=(Split-Path $PSScriptRoot -Parent))
 Import-Module "$PSScriptRoot/../system/OpenGuidePlatform.PowerShell.PlatformBuild/OpenGuidePlatform.PowerShell.PlatformBuild.psm1"
-$version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot
+if($env:GITHUB_ACTIONS -eq 'true' -and $env:GITHUB_REF -like 'refs/tags/*'){
+    if($env:GITHUB_REF -cnotmatch '^refs/tags/v([0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?)$'){
+        throw "Unsupported platform release tag: $env:GITHUB_REF"
+    }
+    $releaseVersion=$Matches[1]
+    $parsedVersion=$null
+    if(-not [System.Management.Automation.SemanticVersion]::TryParse($releaseVersion,[ref]$parsedVersion) -or $parsedVersion.ToString() -cne $releaseVersion){
+        throw "Unsupported platform release tag: $env:GITHUB_REF"
+    }
+    $tagCommit=(& git -C $WorkspaceRoot rev-parse "$($env:GITHUB_REF)^{commit}" 2>$null)
+    if($LASTEXITCODE -ne 0){throw "Cannot resolve platform release tag: $env:GITHUB_REF"}
+    $version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot -Version $releaseVersion
+    if($tagCommit.Trim() -cne $version.Sha){throw "Platform release tag $env:GITHUB_REF does not identify the checked-out commit."}
+}else{
+    $version=Get-PlatformBuildVersion -WorkspaceRoot $WorkspaceRoot
+}
 if($env:GITHUB_OUTPUT){[IO.File]::AppendAllText($env:GITHUB_OUTPUT,"semVer=$($version.SemVer)`nsha=$($version.Sha)`n")}
 $version
diff --git a/tests/Core/PlatformTagVersion.Tests.ps1 b/tests/Core/PlatformTagVersion.Tests.ps1
new file mode 100644
index 0000000..759346d
--- /dev/null
+++ b/tests/Core/PlatformTagVersion.Tests.ps1
@@ -0,0 +1,58 @@
+BeforeAll {
+    $root=Split-Path (Split-Path $PSScriptRoot -Parent) -Parent
+    $entry=Join-Path $root '.build/Get-PlatformVersion.ps1'
+}
+
+Describe 'Platform version selection for a pushed release tag' {
+    BeforeEach {
+        $fixture=Join-Path $TestDrive ([guid]::NewGuid().ToString('N'))
+        New-Item -ItemType Directory $fixture|Out-Null
+        git init -q -b main $fixture
+        git -C $fixture -c user.name=Test -c user.email=test@example.test commit --allow-empty -qm 'Release source'
+        git -C $fixture tag v1.0.1
+        git -C $fixture tag v1.0.1-Preview.6
+        git -C $fixture tag v1.0.2
+        $commit=(git -C $fixture rev-parse HEAD).Trim()
+        $priorActions=$env:GITHUB_ACTIONS
+        $priorRef=$env:GITHUB_REF
+        $priorOutput=$env:GITHUB_OUTPUT
+        $env:GITHUB_ACTIONS='true'
+        $env:GITHUB_REF='refs/tags/v1.0.2'
+        $env:GITHUB_OUTPUT=Join-Path $fixture 'github-output.txt'
+    }
+    AfterEach {
+        $env:GITHUB_ACTIONS=$priorActions
+        $env:GITHUB_REF=$priorRef
+        $env:GITHUB_OUTPUT=$priorOutput
+    }
+    It 'uses the pushed exact tag even when other release tags identify the same commit' {
+        $result=& $entry -WorkspaceRoot $fixture
+        $result.SemVer|Should -BeExactly '1.0.2'
+        $result.Sha|Should -BeExactly $commit
+        Get-Content $env:GITHUB_OUTPUT|Should -Be @('semVer=1.0.2',"sha=$commit")
+    }
+    It 'rejects a tag that does not identify the checked-out source' {
+        git -C $fixture -c user.name=Test -c user.email=test@example.test commit --allow-empty -qm 'Later source'
+        { & $entry -WorkspaceRoot $fixture }|Should -Throw '*does not identify the checked-out commit*'
+    }
+    It 'rejects an unsupported tag before calculating a version' {
+        $env:GITHUB_REF='refs/tags/v1.0'
+        { & $entry -WorkspaceRoot $fixture }|Should -Throw '*Unsupported platform release tag*'
+    }
+    It 'rejects noncanonical semantic version <Tag> without writing workflow outputs' -ForEach @(
+        @{Tag='v01.0.0'}
+        @{Tag='v1.0.0-.alpha'}
+        @{Tag='v1.0.0-01'}
+    ) {
+        git -C $fixture tag $Tag
+        $env:GITHUB_REF="refs/tags/$Tag"
+        { & $entry -WorkspaceRoot $fixture }|Should -Throw '*Unsupported platform release tag*'
+        Test-Path $env:GITHUB_OUTPUT|Should -BeFalse
+    }
+    It 'uses the exact prerelease tag when stable tags identify the same commit' {
+        $env:GITHUB_REF='refs/tags/v1.0.1-Preview.6'
+        $result=& $entry -WorkspaceRoot $fixture
+        $result.SemVer|Should -BeExactly '1.0.1-Preview.6'
+        $result.Sha|Should -BeExactly $commit
+    }
+}