diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 536433b..208628e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,10 +62,21 @@ jobs:
             - name: Run tests
               run: python -m tox -e flake8_7 -- --onlyfuzz --no-cov -n auto
 
+    check_release:
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+        if: ${{ ! contains(github.event.issue.labels.*.name, 'skip-release') }}
+        steps:
+            - uses: actions/checkout@v4
+            - name: Set up Python 3
+              uses: actions/setup-python@v5
+            - name: Test changelog & version python tests/test_changelog_and_version.py --ensure-tag
+
     release:
         runs-on: ubuntu-latest
-        needs: [pyright, test]
-        if: github.repository == 'python-trio/flake8-async' &&  github.ref == 'refs/heads/main'
+        needs: [pyright, test, check_release]
+        if: github.repository == 'python-trio/flake8-async' && github.ref == 'refs/heads/main'
         steps:
             - uses: actions/checkout@v4
             - name: Set up Python 3
@@ -77,5 +88,4 @@ jobs:
                   TWINE_USERNAME: __token__
                   TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
               run: |
-                  python tests/test_changelog_and_version.py --ensure-tag
                   python -m build && twine upload --skip-existing dist/*
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3ec7c04..971afa6 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,8 +3,9 @@ default_language_version:
     python: python3.12
 # pyright requires internet connection to run, which the pre-commit ci app doesn't have.
 # it instead runs in a github action
+# check-relase-changelog is run in CI to be able to access PR labels
 ci:
-    skip: [pyright]
+    skip: [pyright, check-release-changelog]
 
 repos:
     - repo: https://github.com/astral-sh/ruff-pre-commit
@@ -100,3 +101,16 @@ repos:
       rev: v1.0.0
       hooks:
           - id: sphinx-lint
+
+    - repo: local
+      hooks:
+          - id: check-release-changelog
+            name: check-release-changelog
+            language: system
+            entry: python3 tests/check_changelog_and_version.py
+            files: flake8_async/__init__.py|docs/changelog.rst
+
+    - repo: meta
+      hooks:
+          - id: check-hooks-apply
+          - id: check-useless-excludes
diff --git a/docs/changelog.rst b/docs/changelog.rst
index 12bbe51..8631102 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -4,7 +4,7 @@ Changelog
 
 `CalVer, YY.month.patch <https://calver.org/>`_
 
-24.10.2
+24.10.3
 =======
 - :ref:`ASYNC101 <async101>` and :ref:`ASYNC119 <async119>` are now silenced for decorators in :ref:`transform-async-generator-decorators`
 - :ref:`ASYNC102 <async102>` now also warns about ``await()`` inside ``__aexit__``.
diff --git a/tests/test_changelog_and_version.py b/tests/check_changelog_and_version.py
similarity index 97%
rename from tests/test_changelog_and_version.py
rename to tests/check_changelog_and_version.py
index 1d64676..a998279 100755
--- a/tests/test_changelog_and_version.py
+++ b/tests/check_changelog_and_version.py
@@ -112,6 +112,9 @@ def update_version() -> None:
 
 
 if __name__ == "__main__":
+    test_last_release_against_changelog()
+    test_version_increments_are_correct()
+
     update_version()
     if "--ensure-tag" in sys.argv:
         ensure_tagged()