diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 5a1783a..317be28 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -34,6 +34,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Validate release client contract
+        run: ./scripts/ci/release-service-test.sh
+
       - name: Install Python and uv
         run: |
           set -euo pipefail
diff --git a/scripts/ci/release-service-test.sh b/scripts/ci/release-service-test.sh
new file mode 100755
index 0000000..495d423
--- /dev/null
+++ b/scripts/ci/release-service-test.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+test_dir=$(mktemp -d)
+trap 'rm -rf "${test_dir}"' EXIT
+
+true_path=$(type -P true)
+cp "${true_path}" "${test_dir}/ssh"
+digest="registry.dev.nii-ecos.ru/avm/state-corp-backend-web@sha256:$(printf '0%.0s' {1..64})"
+encoded_fixture=$(printf fixture | base64)
+
+release_env=(
+  PATH="${test_dir}:${PATH}"
+  RELEASE_HOST=10.10.0.124
+  RELEASE_USER=ecos-deploy
+  RELEASE_SERVICE_PATH=/opt/ecos-dev/release-service
+  RELEASE_SSH_KEY_B64="${encoded_fixture}"
+  RELEASE_KNOWN_HOSTS_B64="${encoded_fixture}"
+)
+
+env "${release_env[@]}" \
+  "${script_dir}/release-service.sh" \
+  state-corp-backend test-run "${digest}" "${digest}"
+
+if env "${release_env[@]}" \
+  "${script_dir}/release-service.sh" \
+  state-corp-backend test-run \
+  registry.dev.nii-ecos.ru/avm/state-corp-backend-web:dev-deadbee \
+  registry.dev.nii-ecos.ru/avm/state-corp-backend-celery:dev-deadbee \
+  >/dev/null 2>&1; then
+  echo "mutable dev tags must be rejected" >&2
+  exit 1
+fi
+
+echo "release-service digest contract: PASS"
diff --git a/scripts/ci/release-service.sh b/scripts/ci/release-service.sh
index d7d740f..eb4aaee 100755
--- a/scripts/ci/release-service.sh
+++ b/scripts/ci/release-service.sh
@@ -67,7 +67,7 @@ require_safe_value \
   "RELEASE_SERVICE_PATH" "${release_service_path}" '^/[A-Za-z0-9._/-]+$'
 case "${release_service_path}" in
   /opt/ecos-dev/release-service)
-    image_ref_pattern='^[A-Za-z0-9._:/-]+:dev-[a-f0-9]{7,40}$'
+    image_ref_pattern='^[A-Za-z0-9._:/-]+@sha256:[a-f0-9]{64}$'
     [[ "${refresh_data}" == false ]] || fail "dev releases cannot refresh data"
     ;;
   /opt/ecos-main/release-service)