diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 54c78ffcf..b099361a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -133,6 +133,12 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Fetch official upstream release tags
+        run: |
+          git remote add upstream https://github.com/Emanuele-web04/synara.git
+          git remote set-url --push upstream DISABLED
+          git fetch --prune upstream
+
       - name: Fetch official release lineage
         run: git fetch --no-tags origin +refs/heads/release/stable:refs/remotes/origin/release/stable
 
diff --git a/scripts/release-smoke.ts b/scripts/release-smoke.ts
index 80c9cd36b..739570b3b 100644
--- a/scripts/release-smoke.ts
+++ b/scripts/release-smoke.ts
@@ -282,6 +282,33 @@ function verifyReleaseWorkflowSafety(): void {
   const preflightSteps = parsedWorkflow.jobs?.preflight?.steps ?? [];
   const buildPermissions = parsedWorkflow.jobs?.build?.permissions ?? {};
   const buildCheckout = buildSteps.find((step) => step.name === "Checkout");
+  const upstreamTagFetchIndex = preflightSteps.findIndex(
+    (step) => step.name === "Fetch official upstream release tags",
+  );
+  const releaseLineageFetchIndex = preflightSteps.findIndex(
+    (step) => step.name === "Fetch official release lineage",
+  );
+  const migrationCheckIndex = preflightSteps.findIndex(
+    (step) => step.name === "Verify append-only migration lineage",
+  );
+  const upstreamTagFetch = preflightSteps[upstreamTagFetchIndex];
+  const expectedUpstreamTagFetch = [
+    "git remote add upstream https://github.com/Emanuele-web04/synara.git",
+    "git remote set-url --push upstream DISABLED",
+    "git fetch --prune upstream",
+  ].join("\n");
+  if (
+    upstreamTagFetchIndex < 0 ||
+    releaseLineageFetchIndex < 0 ||
+    migrationCheckIndex < 0 ||
+    upstreamTagFetchIndex > migrationCheckIndex ||
+    releaseLineageFetchIndex > migrationCheckIndex ||
+    upstreamTagFetch?.run?.trim() !== expectedUpstreamTagFetch
+  ) {
+    throw new Error(
+      "Expected release preflight to fetch the official upstream tags through a fetch-only remote before checking migration lineage.",
+    );
+  }
   const requiredNativeBuildMatrix = [
     {
       label: "macOS arm64",