diff --git a/.gitea/workflows/publish.yaml b/.gitea/workflows/publish.yaml
index 886f884..869ce25 100644
--- a/.gitea/workflows/publish.yaml
+++ b/.gitea/workflows/publish.yaml
@@ -124,8 +124,21 @@ jobs:
           helm lint deploy/helm/ai-spel-frontend
           helm package deploy/helm/ai-spel-frontend --destination "$publish_dir" \
             --version "$version" --app-version "$version"
+          registry_config="$RUNNER_TEMP/helm/registry.json"
+          printf '{}' > "$registry_config"
+          printf '%s' "$HARBOR_PASSWORD" | helm registry login harbor.k3s.k0.nu \
+            --username "$HARBOR_USERNAME" --password-stdin \
+            --registry-config "$registry_config"
           helm push "$publish_dir/ai-spel-frontend-$version.tgz" \
-            oci://harbor.k3s.k0.nu/ai-spel
+            oci://harbor.k3s.k0.nu/ai-spel --registry-config "$registry_config"
+          chart_metadata="$(helm show chart oci://harbor.k3s.k0.nu/ai-spel/ai-spel-frontend \
+            --version "$version" --registry-config "$registry_config")"
+          chart_version="$(printf '%s\n' "$chart_metadata" | awk '$1 == "version:" { print $2 }')"
+          chart_app_version="$(printf '%s\n' "$chart_metadata" | awk '$1 == "appVersion:" { gsub(/"/, "", $2); print $2 }')"
+          [[ "$chart_version" == "$version" && "$chart_app_version" == "$version" ]] || {
+            echo "Published frontend chart version mismatch: chart=$chart_version app=$chart_app_version expected=$version"
+            exit 1
+          }
           helm template ai-spel-frontend "$publish_dir/ai-spel-frontend-$version.tgz" \
             --namespace ai-spel > "$publish_dir/frontend-manifest.yaml"