diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7b6f9d6..0904b93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,12 +16,17 @@ on:
         required: true
         type: string
 
-permissions:
-  contents: write
-
 jobs:
+  # Gate: run the full lint + test matrix on the release ref before building.
+  # Reuses tests.yml so the release checks and the push/PR checks stay identical.
+  verify:
+    uses: ./.github/workflows/tests.yml
+
   release:
+    needs: verify
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 51ac17e..ed957e8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,6 +5,7 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_call: # lets release.yml run this as a pre-release gate
 
 permissions:
   contents: read