diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f5a2865..79912d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,30 @@ permissions:
   contents: read
 
 jobs:
+  # A pull request must include the latest release of its base branch. One made from an old main undoes what
+  # was fixed since, and conflicts. Lagging a few commits behind is fine: it only gets a notice.
+  base:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          # the branch as pushed, not the merge GitHub prepares (that one always contains the base branch)
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: The branch includes the latest release
+        env:
+          BASE: ${{ github.event.pull_request.base.ref }}
+        run: |
+          git fetch --quiet origin "+refs/heads/$BASE:refs/remotes/origin/$BASE" '+refs/tags/*:refs/tags/*'
+          behind=$(git rev-list --count HEAD..origin/$BASE)
+          tag=$(git tag --merged origin/$BASE --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1)
+          if [ -n "$tag" ] && ! git merge-base --is-ancestor "$tag" HEAD; then
+            echo "::error::This branch starts before $tag: it is $behind commits behind $BASE. Update it from $BASE (git fetch upstream && git rebase upstream/$BASE, or git merge upstream/$BASE), then push again."
+            exit 1
+          fi
+          if [ "$behind" -gt 0 ]; then echo "::notice::This branch includes $tag but is $behind commits behind $BASE."; else echo "Up to date with $BASE."; fi
+
   test:
     runs-on: ubuntu-latest
     steps:
diff --git a/README.md b/README.md
index e197c81..5955537 100644
--- a/README.md
+++ b/README.md
@@ -142,4 +142,4 @@ The hero film is made from code in `hero-film/`: `capture.mjs` takes real screen
 
 Muster is free software under the [GNU AGPL v3 or later](LICENSE): if you offer a modified version to users over a network, you must give them its source code.
 
-Contributions follow the [Solid standard](https://github.com/SolidGeeks/.github/blob/main/CONTRIBUTING.md): sign off every commit with `git commit -s` (DCO), no CLA. To report a vulnerability, see [SECURITY.md](SECURITY.md).
+Contributions follow the [Solid standard](https://github.com/SolidGeeks/.github/blob/main/CONTRIBUTING.md): sign off every commit with `git commit -s` (DCO), no CLA. Start your branch from the current `main`: the `base` job of the CI fails when a pull request does not include the latest release (`v…` tag), and says how to update it. To report a vulnerability, see [SECURITY.md](SECURITY.md).