diff --git a/.github/scripts/publish_r2_release.py b/.github/scripts/publish_r2_release.py
index 19554ffe4e..59825358aa 100755
--- a/.github/scripts/publish_r2_release.py
+++ b/.github/scripts/publish_r2_release.py
@@ -30,7 +30,12 @@ PREFIX = "codex"
 REPOSITORY = "openai/codex"
 RELEASE_METADATA_NAME = "release.json"
 INSTALLER_NAMES = ("install.sh", "install.ps1")
-VERSION_RE = re.compile(r"^[0-9]+\.[0-9]+\.[0-9]+(?:-(?:alpha|beta)(?:\.[0-9]+)?)?$")
+# Keep this pattern in sync with release-tag validation in
+# .github/workflows/rust-release.yml.
+VERSION_RE = re.compile(
+    r"^[0-9]+\.[0-9]+\.[0-9]+(?:-(?:alpha(?:\.[0-9]+){0,2}"
+    r"|beta(?:\.[0-9]+)?))?$"
+)
 CRC64_RE = re.compile(r"^[A-Za-z0-9+/]{11}=$")
 SHA256_RE = re.compile(r"^sha256:([0-9a-f]{64})$")
 
diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index a1d27caeba..359e511ce1 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -40,6 +40,8 @@ jobs:
             || { echo "❌  Not a tag ref"; exit 1; }
 
           # Release tags must match the version in Cargo.toml.
+          # Keep this pattern in sync with VERSION_RE in
+          # .github/scripts/publish_r2_release.py.
           [[ "${GITHUB_REF_NAME}" =~ ^rust-v[0-9]+\.[0-9]+\.[0-9]+(-(alpha(\.[0-9]+){0,2}|beta(\.[0-9]+)?))?$ ]] \
             || { echo "❌  Tag '${GITHUB_REF_NAME}' doesn't match expected format"; exit 1; }