diff --git a/release.sh b/release.sh
old mode 100644
new mode 100755
index 6b86ab6..0f44a5b
--- a/release.sh
+++ b/release.sh
@@ -1,13 +1,40 @@
 #! /usr/bin/env nix
-#! nix shell nixpkgs#nodejs --command bash
+#! nix shell nixpkgs#bash nixpkgs#bun nixpkgs#git nixpkgs#nodejs --command bash
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  printf 'Usage: %s <version>\n' "$0" >&2
+  exit 1
+fi
+
+version="$1"
+branch="$(git branch --show-current)"
+
+if [[ "$branch" != "main" ]]; then
+  printf 'Release must run from main, current branch: %s\n' "$branch" >&2
+  exit 1
+fi
+
+if [[ -n "$(git status --porcelain)" ]]; then
+  printf 'Working tree must be clean before releasing.\n' >&2
+  exit 1
+fi
+
+git fetch origin main --tags
+
+if ! git merge-base --is-ancestor origin/main HEAD; then
+  printf 'Local main is behind origin/main. Pull or rebase before releasing.\n' >&2
+  exit 1
+fi
 
 bun run typecheck
 bun run clean
 bun run build
 
-npm version "$1"
+npm version "$version"
 
 git push origin main
-git push origin "v$1"
+git push origin "v$version"
 
 # vim: set ft=bash :