diff --git a/.github/scripts/check-version-sync.sh b/.github/scripts/check-version-sync.sh
new file mode 100644
index 0000000..5b2fd0e
--- /dev/null
+++ b/.github/scripts/check-version-sync.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SNAP_VERSION="$(sed -n 's/^version:[[:space:]]*\(.*\)$/\1/p' snap/snapcraft.yaml | head -n1 | tr -d '"' | xargs)"
+GO_VERSION="$(sed -n 's/^var version = "\([^"]*\)"$/\1/p' aproxy.go | head -n1)"
+
+if [[ -z "$SNAP_VERSION" ]]; then
+  echo "Could not parse version from snap/snapcraft.yaml"
+  exit 1
+fi
+
+if [[ -z "$GO_VERSION" ]]; then
+  echo "Could not parse version from aproxy.go"
+  exit 1
+fi
+
+if [[ "$SNAP_VERSION" != "$GO_VERSION" ]]; then
+  echo "Version mismatch detected"
+  echo "snap/snapcraft.yaml version: $SNAP_VERSION"
+  echo "aproxy.go version:         $GO_VERSION"
+  echo "Keep both versions synchronized before merging or releasing."
+  exit 1
+fi
+
+echo "Version check passed: $GO_VERSION"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 05cd368..0b03f82 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,11 +2,6 @@ name: Release
 
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag (e.g., v1.0.0)'
-        required: true
-        type: string
 
 permissions:
   contents: write
@@ -24,10 +19,23 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
+      - name: Validate Version Sync
+        run: |
+          bash .github/scripts/check-version-sync.sh
+
       - name: Create tag
         id: tag
         run: |
-          TAG="${{ inputs.tag }}"
+          GO_VERSION="$(sed -n 's/^var version = "\([^"]*\)"$/\1/p' aproxy.go | head -n1)"
+          if [[ -z "$GO_VERSION" ]]; then
+            echo "Could not parse version from aproxy.go"
+            exit 1
+          fi
+          TAG="v${GO_VERSION}"
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists. Please bump the version in aproxy.go and snap/snapcraft.yaml before releasing."
+            exit 1
+          fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           git tag -a "$TAG" -m "Release $TAG"
           git push origin "$TAG"
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index c59b4d7..f7d3bd3 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -22,6 +22,10 @@ jobs:
           go fmt ./...
           git diff --exit-code
 
+      - name: Check Version Sync
+        run: |
+          bash .github/scripts/check-version-sync.sh
+
       - name: Build and Test
         run: |
           go test -race ./...
diff --git a/aproxy.go b/aproxy.go
index d5392fc..085a71e 100644
--- a/aproxy.go
+++ b/aproxy.go
@@ -24,7 +24,7 @@ import (
 	"golang.org/x/crypto/cryptobyte"
 )
 
-var version = "0.2.4"
+var version = "0.2.5"
 
 // PrereadConn is a wrapper around net.Conn that supports pre-reading from the underlying connection.
 // Any Read before the EndPreread can be undone and read again by calling the EndPreread function.