diff --git a/‎.github/workflows/version-check.yml‎
Lines changed: 72 additions & 10 deletions b/‎.github/workflows/version-check.yml‎
Lines changed: 72 additions & 10 deletions
@@ -6,6 +6,8 @@ on:
       - 'socketsecurity/**'
       - 'pyproject.toml'
       - 'uv.lock'
+      # Included so a change to the check itself is exercised by its own PR.
+      - '.github/workflows/version-check.yml'
 
 permissions:
   contents: read
@@ -42,16 +44,60 @@ jobs:
           export PR_VERSION
           export MAIN_VERSION
 
-          # Compare against both main and latest published PyPI release.
+          # Only enforce a bump when the PR actually changes shipped content.
+          # This workflow sits in its own paths filter so edits to it are
+          # exercised, but a CI-only change ships nothing and must not be told
+          # to cut a release. The comparison still runs and reports either way.
+          if git diff --name-only origin/main...HEAD \
+             | grep -qE '^(socketsecurity/|pyproject\.toml$|uv\.lock$)'; then
+            PACKAGE_CHANGED=true
+          else
+            PACKAGE_CHANGED=false
+          fi
+          export PACKAGE_CHANGED
+
+          # Compare against the latest published PyPI release.
           python3 <<'PY'
           import json
           import os
+          import tomllib
           import urllib.request
           from packaging import version
 
           pr_ver = version.parse(os.environ["PR_VERSION"])
           main_ver = version.parse(os.environ["MAIN_VERSION"])
 
+          enforced = os.environ["PACKAGE_CHANGED"] == "true"
+
+          def reject(message):
+              print(message)
+              if enforced:
+                  raise SystemExit(1)
+              print(
+                  "ℹ️  Not enforced: this PR changes no packaged files, "
+                  "so it ships nothing that needs a new version."
+              )
+              raise SystemExit(0)
+
+          with open("pyproject.toml", "rb") as fh:
+              pyproject_ver = version.parse(tomllib.load(fh)["project"]["version"])
+
+          # The version is two hand-maintained literals with nothing deriving one
+          # from the other: pyproject.toml is what actually gets published, and
+          # socketsecurity/__init__.py is what the CLI reports as its User-Agent.
+          # Every comparison below reads only __init__.py, so bumping that alone
+          # would pass this job and then publish under the old number -- caught
+          # late, by twine rejecting an existing file, after the merge. Require
+          # the two to agree before comparing anything. (uv.lock carries a third
+          # copy, but uv derives it and `uv lock --locked` in python-tests
+          # already fails when it drifts.)
+          if pr_ver != pyproject_ver:
+              reject(
+                  f"❌ Version mismatch inside the PR: pyproject.toml is "
+                  f"{pyproject_ver}, socketsecurity/__init__.py is {pr_ver}. "
+                  f"Bump both."
+              )
+
           with urllib.request.urlopen("https://pypi.org/pypi/socketsecurity/json") as response:
               pypi_data = json.load(response)
 
@@ -62,19 +108,35 @@ jobs:
                   published_versions.append(parsed)
 
           pypi_ver = max(published_versions) if published_versions else version.parse("0.0.0")
-          required_floor = max(main_ver, pypi_ver)
 
-          if pr_ver <= required_floor:
+          # The only hard requirement is that the version is ahead of what is
+          # actually released. Treating main's version as a second floor breaks
+          # the legitimate case where several PRs share one unreleased release:
+          # the first bumps main to the new version and the rest ride it without
+          # bumping again, which is what keeps them under a single changelog
+          # header. Main is therefore only a floor when this PR moves the
+          # version -- a change to it must go forwards, never backwards.
+          if pr_ver <= pypi_ver:
+              reject(
+                  f"❌ Version {pr_ver} is already published on PyPI "
+                  f"(latest release: {pypi_ver}). Bump it."
+              )
+
+          if pr_ver < main_ver:
+              reject(
+                  f"❌ Version moves backwards: main is {main_ver}, PR is {pr_ver}."
+              )
+
+          if pr_ver == main_ver:
               print(
-                  f"❌ Version must be greater than main and PyPI! "
+                  f"✅ Riding main's unreleased {pr_ver} "
+                  f"(latest PyPI release: {pypi_ver})."
+              )
+          else:
+              print(
+                  f"✅ Version properly incremented. "
                   f"Main: {main_ver}, PyPI: {pypi_ver}, PR: {pr_ver}"
               )
-              raise SystemExit(1)
-
-          print(
-              f"✅ Version properly incremented. "
-              f"Main: {main_ver}, PyPI: {pypi_ver}, PR: {pr_ver}"
-          )
           PY
 
       - name: Require uv.lock update when pyproject changes