diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 930ae24..715cfe0 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -13,7 +13,10 @@
 #   Python: pip install "git+https://github.com/outshift-open/quantum-hal.git@vX.Y.Z#subdirectory=sdk/python"
 #
 # A maintainer creates the `vX.Y.Z` tag manually once a PR with
-# up-to-date generated SDKs has merged to `main`. This workflow runs
+# up-to-date generated SDKs has merged to `main`. Before tagging,
+# sdk/python/pyproject.toml's `project.version` must already be bumped
+# to match the upcoming tag (in its own merged PR) -- validate-python
+# below fails if the versions don't match. This workflow runs
 # after that tag lands, and does two things:
 #   1. Validates both install paths actually work from the tagged commit.
 #   2. Creates the one piece of state the repo tag alone doesn't provide:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b6cc677..4974abf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -61,6 +61,14 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   versioning policy below: a release tag now covers the whole spec (all
   device-type packages) and both generated SDKs together, not one device
   type at a time.
+- Before cutting *any* release tag, `sdk/python/pyproject.toml`'s
+  `project.version` must first be bumped to the target version in its
+  own PR and merged to `main` — e.g. going from `v0.0.1` to `v0.0.2`
+  requires a PR bumping `project.version` from `0.0.1` to `0.0.2`,
+  merged *before* `v0.0.2` is tagged. `publish.yaml`'s `validate-python`
+  job fails the tag's CI run if `pyproject.toml`'s version doesn't match
+  the tag. The Go SDK needs no equivalent bump, since its version comes
+  from the tag itself via the derived `sdk/go/vX.Y.Z` tag below.
 - `sdk/go` additionally gets a matching nested-module tag,
   `sdk/go/vMAJOR.MINOR.PATCH`, pointing at the same commit — required
   because `sdk/go` is a nested Go module (own `go.mod`) and Go's module
diff --git a/README.md b/README.md
index c91958e..429ae45 100644
--- a/README.md
+++ b/README.md
@@ -115,10 +115,14 @@ existing adapters work.
 GitHub is the schema registry here (protos + git history + tags). Pull
 requests that touch `proto/` must include the regenerated SDKs —
 `proto-ci.yml` regenerates both and fails the pipeline on any diff, so
-contributors run `make generate` and commit the result themselves. Once
-such a PR merges, a maintainer tags the release manually
-(`git tag vX.Y.Z && git push origin vX.Y.Z`); `publish.yaml` then
-validates both SDKs and tags the nested `sdk/go` module. See
+contributors run `make generate` and commit the result themselves.
+Before tagging, `sdk/python/pyproject.toml`'s `project.version` must be
+bumped to match the upcoming tag in its own PR and merged to `main` —
+`publish.yaml`'s `validate-python` job fails CI if the two don't match
+(the Go SDK's version comes from the tag itself, so it needs no such
+bump). Once that version-bump PR merges, a maintainer tags the release
+manually (`git tag vX.Y.Z && git push origin vX.Y.Z`); `publish.yaml`
+then validates both SDKs and tags the nested `sdk/go` module. See
 [Installing the SDKs](#installing-the-sdks) and `CHANGELOG.md`'s
 versioning policy.
 
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
index fdffe3b..9e7361c 100644
--- a/sdk/python/pyproject.toml
+++ b/sdk/python/pyproject.toml
@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "quantum-hal-sdk"
-version = "0.0.0"
+version = "0.0.1"
 description = "Generated Python SDK for the Cisco Quantum Network Controller HAL proto schema"
 requires-python = ">=3.9"
 dependencies = [