diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml
index 090c880..5a85043 100644
--- a/.github/workflows/release-dry-run.yml
+++ b/.github/workflows/release-dry-run.yml
@@ -30,7 +30,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Validate prospective release tag
-        run: npm run release:tag -- "v$(node -p \"require('./package.json').version\")"
+        run: |
+          prospective_tag="v$(node -p "require('./package.json').version")"
+          npm run release:tag -- "$prospective_tag"
       - name: Install ReleaseBox
         run: |
           set -euo pipefail
diff --git a/tests/release.test.mjs b/tests/release.test.mjs
index b195fb8..a5e1bcc 100644
--- a/tests/release.test.mjs
+++ b/tests/release.test.mjs
@@ -24,5 +24,17 @@ test("release workflow validates before publishing and publishes before GitHub r
 
 test("dry run validates a prospective package tag", () => {
   const workflow = readFileSync(".github/workflows/release-dry-run.yml", "utf8");
-  assert.match(workflow, /npm run release:tag -- "v\$\(node/);
+  const step = workflow.match(/- name: Validate prospective release tag\n {8}run: \|\n((?: {10}.*\n)+)/);
+  assert.ok(step, "prospective release tag step must use a shell block");
+
+  const command = step[1]
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => line.slice(10))
+    .join("\n");
+  const run = spawnSync("bash", ["-euo", "pipefail", "-c", command], { encoding: "utf8" });
+
+  assert.equal(run.status, 0, run.stderr);
+  assert.match(run.stdout, /Release tag v0\.1\.0 matches package version 0\.1\.0\./);
+  assert.ok(workflow.indexOf("Validate prospective release tag") < workflow.indexOf("Run release checks"));
 });