diff --git a/.github/workflows/build-app.yaml b/.github/workflows/build-app.yaml
index 666a40c9..94693131 100644
--- a/.github/workflows/build-app.yaml
+++ b/.github/workflows/build-app.yaml
@@ -3,8 +3,7 @@ name: App
 on:
   pull_request:
   push:
-    branches:
-      - release
+    # Cannot filter on both branches (release) and tags - it's ORed
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
       - '[0-9]+.[0-9]+.[0-9]+-rc\.[0-9]+(\.[0-9]+)?'
@@ -48,6 +47,13 @@ jobs:
     runs-on: ubuntu-latest
     container: ghcr.io/syncthing/syncthing-android-builder
     steps:
+      - name: Ensure release branch
+        run: |
+          if ! git branch --contains $(git rev-parse HEAD) | grep release >/dev/null; then
+            echo "Tag is not part of release branch - aborting..."
+            exit 1
+          fi
+
       - uses: actions/checkout@v3
         with:
           submodules: true