diff --git a/.github/workflows/whisper-vulkan.yml b/.github/workflows/whisper-vulkan.yml
index ef4a28c..eb9bc32 100644
--- a/.github/workflows/whisper-vulkan.yml
+++ b/.github/workflows/whisper-vulkan.yml
@@ -21,6 +21,14 @@ on:
         required: true
         default: "371b5a7561823ab2bb32142d2751e35e7534727b"
         type: string
+      expected_sha256:
+        description: >-
+          Reviewed archive SHA-256. Leave empty for a version this file has
+          not reviewed: the digest of what was built is reported instead of
+          being checked, and publishing is refused.
+        required: false
+        default: ""
+        type: string
       publish:
         description: Publish a Dikte dependency release
         required: true
@@ -37,7 +45,8 @@ concurrency:
 env:
   WHISPER_VERSION: ${{ inputs.whisper_version || '1.9.3' }}
   WHISPER_COMMIT: ${{ inputs.whisper_commit || '371b5a7561823ab2bb32142d2751e35e7534727b' }}
-  MANAGED_WHISPER_SHA256: c25ca76504144da488eb74441390a7b9aa7ce547e5f2f391cbd831253c9b54d8
+  REVIEWED_WHISPER_VERSION: "1.9.3"
+  REVIEWED_WHISPER_SHA256: c25ca76504144da488eb74441390a7b9aa7ce547e5f2f391cbd831253c9b54d8
 
 jobs:
   build:
@@ -49,6 +58,13 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Validate source coordinates
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$WHISPER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          [[ "$WHISPER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+
       - name: Check out pinned whisper.cpp source
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
@@ -58,13 +74,6 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Validate source coordinates
-        shell: bash
-        run: |
-          set -euo pipefail
-          [[ "$WHISPER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          [[ "$WHISPER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
-
       - name: Verify source version and commit
         shell: bash
         run: |
@@ -92,9 +101,31 @@ jobs:
 
       - name: Verify reviewed archive digest
         shell: bash
+        env:
+          EXPECTED_SHA256: ${{ inputs.expected_sha256 }}
+          PUBLISH: ${{ inputs.publish }}
         run: |
+          set -euo pipefail
           read -r actual _ < dist/whisper-bin-ubuntu-vulkan-x64.tar.gz.sha256
-          test "$actual" = "$MANAGED_WHISPER_SHA256"
+          echo "built archive sha256: $actual"
+          expected="$EXPECTED_SHA256"
+          if [ -z "$expected" ] \
+              && [ "$WHISPER_VERSION" = "$REVIEWED_WHISPER_VERSION" ]; then
+            expected="$REVIEWED_WHISPER_SHA256"
+          fi
+          if [ -z "$expected" ]; then
+            # The digest of a version nobody has reviewed yet cannot be known
+            # before it is built. Reporting it is the whole point of the run;
+            # a release out of it is not.
+            if [ "${PUBLISH:-false}" = true ]; then
+              echo "refusing to publish an archive whose digest has not been reviewed" >&2
+              exit 1
+            fi
+            echo "::notice::no reviewed digest for $WHISPER_VERSION." \
+                 "Review the one above, then dispatch again with expected_sha256."
+            exit 0
+          fi
+          test "$actual" = "$expected"
 
       - name: Validate archive and ELF contract
         run: OUT_DIR=dist packaging/whisper-vulkan/validate-package.sh
diff --git a/tests/test_packaging.py b/tests/test_packaging.py
index fdbfcb9..dde74b6 100644
--- a/tests/test_packaging.py
+++ b/tests/test_packaging.py
@@ -85,6 +85,20 @@ class WhisperVulkanPackaging(unittest.TestCase):
             self.assertIn(mode, script)
         self.assertTrue((PACKAGING / "Dockerfile.runtime-noicd").is_file())
 
+    def test_an_unreviewed_version_is_reported_and_never_published(self):
+        """The digest of a version nobody has reviewed cannot be known before
+        it is built, so the gate cannot be the only way through."""
+        workflow = WORKFLOW.read_text(encoding="utf-8")
+        self.assertIn("expected_sha256", workflow)
+        self.assertIn(
+            "refusing to publish an archive whose digest has not been reviewed",
+            workflow)
+
+    def test_the_shape_of_the_inputs_is_checked_before_they_are_used(self):
+        workflow = WORKFLOW.read_text(encoding="utf-8")
+        self.assertLess(workflow.index("- name: Validate source coordinates"),
+                        workflow.index("- name: Check out pinned whisper.cpp"))
+
     def test_the_validator_checks_tar_links_before_extraction(self):
         validator = (PACKAGING / "validate-package.sh").read_text(
             encoding="utf-8")