diff --git a/package.json b/package.json
index 7118495eab..b05b58d3b2 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "publish:sandbox": "node scripts/publish-sandbox.js",
     "publish:npm": "npm publish --workspaces ${NPM_PUBLISH_TAG:+--tag=$NPM_PUBLISH_TAG} ${NPM_DRY_RUN:+--dry-run}",
     "publish:release": "npm run prepare:package && npm run build:packages && npm run build:sandbox:fast && npm run publish:sandbox && npm run publish:npm",
-    "prepublishOnly": "node scripts/prepublish.js",
+    "prepublishOnly": "node scripts/check-versions.js && node scripts/prepublish.js",
     "release:version": "node scripts/version.js",
     "push-release": "git push && git push --tags"
   },
diff --git a/scripts/check-versions.js b/scripts/check-versions.js
new file mode 100644
index 0000000000..3403191380
--- /dev/null
+++ b/scripts/check-versions.js
@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { readFileSync } from 'fs';
+import path from 'path';
+
+function readPackageJson(dir) {
+  const p = path.join(dir, 'package.json');
+  return JSON.parse(readFileSync(p, 'utf-8'));
+}
+
+const root = readPackageJson('.');
+const cli = readPackageJson('packages/cli');
+const core = readPackageJson('packages/core');
+
+const errors = [];
+
+console.log('Checking version consistency...');
+
+// 1. Check that all package versions are the same.
+if (root.version !== cli.version || root.version !== core.version) {
+  errors.push(
+    `Version mismatch: root (${root.version}), cli (${cli.version}), core (${core.version})`,
+  );
+} else {
+  console.log(`- All packages are at version ${root.version}.`);
+}
+
+// 2. Check that the cli's dependency on core matches the core version.
+const coreDepVersion = cli.dependencies['@google/gemini-core'];
+if (coreDepVersion !== `^${core.version}`) {
+  errors.push(
+    `CLI dependency on core is wrong: expected ^${core.version}, got ${coreDepVersion}`,
+  );
+} else {
+  console.log(
+    `- CLI dependency on core (${coreDepVersion}) is correct.`,
+  );
+}
+
+// 3. Check that the sandbox image tag matches the root version.
+const imageUri = root.config.sandboxImageUri;
+const imageTag = imageUri.split(':').pop();
+if (imageTag !== root.version) {
+  errors.push(
+    `Sandbox image tag mismatch: expected ${root.version}, got ${imageTag}`,
+  );
+} else {
+  console.log(`- Sandbox image tag (${imageTag}) is correct.`);
+}
+
+if (errors.length > 0) {
+  console.error('\nVersion consistency checks failed:');
+  for (const error of errors) {
+    console.error(`- ${error}`);
+  }
+  process.exit(1);
+}
+
+console.log('\nAll version checks passed!');