diff --git a/.github/requirements-twine.txt b/.github/requirements-twine.txt
new file mode 100644
index 0000000..54f4fd7
--- /dev/null
+++ b/.github/requirements-twine.txt
@@ -0,0 +1 @@
+twine==7.0.0
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 0ea944f..a4b6e1a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -43,9 +43,22 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Check out publishing tool requirements from the workflow revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.workflow_sha }}
+          persist-credentials: false
+          sparse-checkout: .github/requirements-twine.txt
+          sparse-checkout-cone-mode: false
+
+      - name: Save publishing tool requirements for historical tags
+        run: cp .github/requirements-twine.txt "$RUNNER_TEMP/requirements-twine.txt"
+
+      - name: Check out the release tag
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
+          persist-credentials: false
 
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
@@ -71,6 +84,9 @@ jobs:
       - name: Build package
         run: uv build
 
+      - name: Check distribution metadata with Twine
+        run: uvx --from twine --constraints "$RUNNER_TEMP/requirements-twine.txt" twine check --strict dist/*
+
       - name: Verify package version matches release tag
         env:
           TAG: ${{ needs.release-please.outputs.tag_name }}
@@ -113,6 +129,6 @@ jobs:
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
         with:
           print-hash: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5ba4bf5..dc94844 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -280,6 +280,9 @@ jobs:
       - name: Build package
         run: uv build
 
+      - name: Check distribution metadata with Twine
+        run: uvx --from twine --constraints .github/requirements-twine.txt twine check --strict dist/*
+
       - name: Upload artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with: