diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3193db..be36796 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,6 +102,41 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Check version consistency
+        if: startsWith(github.ref, 'refs/tags/v')  # only runs on tag pushes, not PRs
+        run: |
+          # Strip 'v' prefix so v0.9.2 → 0.9.2 matches file values.
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          echo "Tag version: $TAG_VERSION"
+
+          # pyproject.toml: value of the `version` key under [project]
+          PYTOML_VERSION=$(python -c "
+          import tomllib
+          with open('pyproject.toml', 'rb') as f:
+              v = tomllib.load(f)['project']['version']
+          print(v)
+          ")
+          echo "pyproject.toml version: $PYTOML_VERSION"
+
+          # hexus/plugin.yaml: value of the top-level `version` key
+          YAML_VERSION=$(python -c "
+          import yaml
+          with open('hexus/plugin.yaml') as f:
+              v = yaml.safe_load(f)['version']
+          print(v)
+          ")
+          echo "hexus/plugin.yaml version: $YAML_VERSION"
+
+          if [ "$TAG_VERSION" != "$PYTOML_VERSION" ]; then
+            echo "ERROR: pyproject.toml version '$PYTOML_VERSION' does not match tag '$TAG_VERSION'"
+            exit 1
+          fi
+          if [ "$TAG_VERSION" != "$YAML_VERSION" ]; then
+            echo "ERROR: hexus/plugin.yaml version '$YAML_VERSION' does not match tag '$TAG_VERSION'"
+            exit 1
+          fi
+          echo "All version fields match tag $TAG_VERSION"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
diff --git a/hexus/plugin.yaml b/hexus/plugin.yaml
index 4b4e4d9..a992368 100644
--- a/hexus/plugin.yaml
+++ b/hexus/plugin.yaml
@@ -1,5 +1,5 @@
 name: hexus
-version: 0.4.0
+version: 0.9.2
 description: "Postgres + hexus storage layer for hermes-agent + MCP server. Mirrors built-in MEMORY.md / USER.md + captures every substantive (user, assistant) chat turn into a conversations table. Per-agent themes (marketing/sales/trading/incident/morning-report/…) via X-Hermes-Session-Key header — every systemd-run minion gets its own scope. 384-dim local BERT (MiniLM-L6-v2) embeddings by default, with HTTP-embed fallback for operators with an existing Ollama endpoint. Async writer + connection pool. No LLM mediation. The same store is exposed as an MCP server (`hexus-mcp serve`) for non-hermes agents (Claude Desktop, Cursor, fleet agents) — one process, one model load, one shared knowledge base."
 pip_dependencies:
   - "psycopg[binary]>=3.3.4"