diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index b0e862c4a..dead96bce 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -1,6 +1,9 @@
 name: DCO
 
 on:
+  push:
+    branches:
+      - main
   pull_request:
     branches:
       - main
@@ -17,18 +20,29 @@ jobs:
         with:
           fetch-depth: 0
 
-      # Every non-merge commit in the pull request must carry a Signed-off-by
+      # Every non-merge commit in the pull request or push must carry a Signed-off-by
       # trailer matching the commit author's email, certifying the Developer
       # Certificate of Origin 1.1 (https://developercertificate.org/).
       # Only commits authored from a GitHub-issued bot address are exempt; a
       # display name is attacker-controlled and must never grant the exemption.
       - name: Check Signed-off-by trailers
         env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+          PUSH_AFTER_SHA: ${{ github.sha }}
         run: |
+          if [ "${EVENT_NAME}" = "pull_request" ]; then
+            rev_range="${PR_BASE_SHA}..${PR_HEAD_SHA}"
+          elif [ -n "${PUSH_BEFORE_SHA}" ] && [ "${PUSH_BEFORE_SHA}" != "0000000000000000000000000000000000000000" ] && git cat-file -e "${PUSH_BEFORE_SHA}^{commit}" 2>/dev/null; then
+            rev_range="${PUSH_BEFORE_SHA}..${PUSH_AFTER_SHA}"
+          else
+            rev_range="${PUSH_AFTER_SHA}^..${PUSH_AFTER_SHA}"
+          fi
           fail=0
           while read -r sha; do
+            [ -n "${sha}" ] || continue
             author_name="$(git log -1 --format='%an' "${sha}")"
             author_email="$(git log -1 --format='%ae' "${sha}")"
             case "${author_email}" in
@@ -39,5 +53,5 @@ jobs:
               echo "::error::commit ${sha} by ${author_name} <${author_email}> lacks a matching Signed-off-by trailer; sign with 'git commit -s', repair with 'git rebase --signoff'"
               fail=1
             fi
-          done < <(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}")
+          done < <(git rev-list --no-merges "${rev_range}")
           exit "${fail}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 635215dcc..d7a4fb880 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -103,6 +103,12 @@ jobs:
             echo "Release tag ${TAG} resolves to ${TAG_COMMIT}, checkout is ${HEAD_COMMIT}" >&2
             exit 1
           fi
+          CHART_APP_VERSION="$(sed -n 's/^appVersion: *//p' helm/silo/Chart.yaml)"
+          CHART_IMAGE_TAG="$(sed -n '/^image:/,/^[^ ]/s/^  tag: *//p' helm/silo/values.yaml)"
+          if [ "${CHART_APP_VERSION}" != "${TAG}" ] || [ "${CHART_IMAGE_TAG}" != "${TAG}" ]; then
+            echo "helm/silo Chart.yaml appVersion (${CHART_APP_VERSION}) and values.yaml image.tag (${CHART_IMAGE_TAG}) must match release tag ${TAG}" >&2
+            exit 1
+          fi
           VERSION_HYPHEN="${TAG#RELEASE.}"
           PKG_VERSION="$(echo "${VERSION_HYPHEN}" | sed -E 's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
           VERSION_COLON="$(echo "${VERSION_HYPHEN}" | sed -E 's/T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/T\1:\2:\3Z/')"
diff --git a/buildscripts/verify-helm-migration.sh b/buildscripts/verify-helm-migration.sh
index 60c94316e..23a63d122 100755
--- a/buildscripts/verify-helm-migration.sh
+++ b/buildscripts/verify-helm-migration.sh
@@ -120,6 +120,10 @@ if [ -z "${app_version}" ] || [ "${image_tag}" != "${app_version}" ]; then
 	echo "helm/silo: image.tag '${image_tag}' must equal appVersion '${app_version}'" >&2
 	exit 1
 fi
+if [ -n "${RELEASE_TAG:-}" ] && [ "${image_tag}" != "${RELEASE_TAG}" ]; then
+	echo "helm/silo: image.tag '${image_tag}' must equal RELEASE_TAG '${RELEASE_TAG}'" >&2
+	exit 1
+fi
 
 helm_run package "${new_chart}" --destination "${output_dir}" >/dev/null
 test -s "${work_dir}/silo-${chart_version}.tgz"