diff --git a/.github/workflows/_container.yml b/.github/workflows/_container.yml
index eafe9231e..c52af34b8 100644
--- a/.github/workflows/_container.yml
+++ b/.github/workflows/_container.yml
@@ -52,9 +52,6 @@ jobs:
           load: true
           tags: tag_for_testing
 
-      - name: Test cli works in cached runtime image
-        run: docker run --rm tag_for_testing --version
-
       - name: Create tags for publishing image
         id: meta
         uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5
@@ -64,6 +61,20 @@ jobs:
             type=ref,event=tag
             type=raw,value=latest
 
+      - name: Test cli works in cached runtime image
+        id: app-version
+        run: |
+          APP_VERSION=$(docker run --rm tag_for_testing --version)
+          echo "Version in built container: $APP_VERSION"
+          echo "version=$APP_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check versions match
+        if: github.ref_type == 'tag'
+        run: '[[ "$APP_VERSION" = "blueapi, version $REPO_VERSION" ]]'
+        env:
+          APP_VERSION: ${{ steps.app-version.outputs.version }}
+          REPO_VERSION: ${{ steps.meta.outputs.version }}
+
       - name: Push cached image to container registry
         if: github.ref_type == 'tag'
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6