diff --git a/.github/workflows/contracts.yml b/.github/workflows/contracts.yml
index 228b09c7..c17b329f 100644
--- a/.github/workflows/contracts.yml
+++ b/.github/workflows/contracts.yml
@@ -32,6 +32,9 @@ jobs:
       - name: Install dependencies
         run: just contracts-deps
 
+      - name: Smoke-test publish version guard
+        run: just contracts-publish-check
+
       - name: Install Bun
         uses: oven-sh/setup-bun@v1
 
diff --git a/justfile b/justfile
index 003be86a..4372cb59 100644
--- a/justfile
+++ b/justfile
@@ -100,10 +100,35 @@ contracts-verify-custom address chain verifier-url *args:
 # Verify on both sourcify and etherscan
 contracts-verify address chain: (contracts-verify-sourcify address chain) (contracts-verify-etherscan address chain)
 
-# Publish contracts
+# Publish contracts to soldeer. VERSION must be semver (e.g. 1.2.0).
+# Flags such as --dry-run go AFTER the version: `just contracts-publish 1.2.0 --dry-run`.
 contracts-publish version *args:
+    @[[ "{{version}}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+ ]] || { echo "error: invalid version '{{version}}'. Expected semver like 1.2.0. Usage: just contracts-publish <version> [flags] (put --dry-run AFTER the version)." >&2; exit 1; }
     cd contracts && forge soldeer push anoma-pa-evm~{{version}} {{ args }}
 
+# Smoke-test the contracts-publish version guard (no network, no publish).
+contracts-publish-check:
+    #!/usr/bin/env bash
+    set -u
+    rc=0
+    for bad in "--dry-run" "-d" "" "1.2" "v1" "abc"; do
+        if just contracts-publish "$bad" >/dev/null 2>&1; then
+            echo "FAIL reject: '$bad' was accepted"; rc=1
+        else
+            echo "ok   reject: '$bad'"
+        fi
+    done
+    for good in "1.2.0" "v0.1.0" "10.20.30"; do
+        out=$(just contracts-publish "$good" --dry-run 2>&1 || true)
+        if grep -q "invalid version" <<<"$out"; then
+            echo "FAIL accept: '$good' was rejected by the guard"; rc=1
+        else
+            echo "ok   accept: '$good'"
+        fi
+    done
+    if [ "$rc" -eq 0 ]; then echo "publish guard smoke: OK"; else echo "publish guard smoke: FAILED"; fi
+    exit $rc
+
 # --- Bindings ---
 
 # Clean bindings