diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c7f11d..fa51d64 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -309,9 +309,15 @@ jobs:
 
       - name: Smoke test ARM64 runtime image
         run: |
+          # `-v` prints the version and returns 1, so it cannot be the last
+          # command under `sh -e`. Pipe it into grep instead: that asserts the
+          # binary runs AND reports the expected release version, and the
+          # pipeline's status is grep's. Without the version match this would
+          # also pass on a stale binary left in the image.
           docker run --rm --entrypoint sh \
+            --env EXPECTED_VERSION="${RELEASE_TAG}" \
             "${IMAGE_PREFIX}:staging-${RELEASE_TAG}-${{ matrix.distro }}-arm64" \
-            -ec 'test "$(dpkg --print-architecture)" = arm64; command -v proxysql_binlog_reader; proxysql_binlog_reader -v'
+            -ec 'test "$(dpkg --print-architecture)" = arm64; command -v proxysql_binlog_reader; proxysql_binlog_reader -v | grep -q "^proxysql_binlog_reader version ${EXPECTED_VERSION}"'
 
   # ---------------------------------------------------------------------------
   # 5. Publish: push verified staging images, then create stable manifests.
diff --git a/test/verify-release-workflow.rb b/test/verify-release-workflow.rb
index 1a0ac18..edc9d2d 100755
--- a/test/verify-release-workflow.rb
+++ b/test/verify-release-workflow.rb
@@ -398,6 +398,18 @@ def assert_release_arm64_smoke_contract(release)
   unless smoke_command.include?("dpkg --print-architecture") && smoke_command.include?("arm64") && smoke_command.include?("proxysql_binlog_reader -v")
     fail("release ARM64 smoke must verify the native package architecture and reader executable")
   end
+  # `proxysql_binlog_reader -v` prints the version and returns 1, so it must not
+  # be the last command in the `sh -e` script: that makes the check fail on
+  # every image and blocks publishing entirely. Require the version assertion to
+  # be a pipeline, so its status comes from grep instead. This is also what
+  # catches a stale binary left in the image, which a bare exit-status check
+  # cannot.
+  if smoke_command.match?(/;\s*proxysql_binlog_reader -v'\s*$/)
+    fail("release ARM64 smoke must not end with a bare `proxysql_binlog_reader -v`: the reader returns 1 for -v, so under `sh -e` the check always fails")
+  end
+  unless smoke_command.include?("| grep -q") && smoke_command.include?("EXPECTED_VERSION")
+    fail("release ARM64 smoke must assert the reader's reported version through a pipeline")
+  end
 end