diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98d30d642..15b45880a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
         if [ ! -f ./metadata/kmwversions.json ]; then
           echo "Failed to generate static file"
           exit 1
-        fi    
+        fi
     #
     # If any of the tests fail, let's grab a bit more detail on the environment
     #
@@ -63,3 +63,16 @@ jobs:
         CONTAINER=`docker container ls -l -q`
         echo "--- PHP errors in Docker log ---"
         docker container logs $CONTAINER 2>&1 | grep 'php7'
+
+    - name: Verify .bootstrap-required-version
+      if: ${{ !cancelled() }}
+      shell: bash
+      run: |
+        # We want to avoid merging a bootstrap version that is not based on a published tag
+        # in the shared-sites repo. We will do this with a heuristic based on the normal
+        # shape of the tags, which is `v#.#.#`. Any other shape we will assume is a test
+        # branch.
+        cat resources/.bootstrap-required-version | grep -qP '^v\d+\.\d+\.\d+$' || (
+          echo "::error file=resources/.bootstrap-required-version,line=1,col=1::This branch cannot be merged, because resources/.bootstrap-required-version references \`$(cat resources/.bootstrap-required-version)\`, which does not appear to be a published tag -- is it a test branch?"
+          exit 1
+        )
diff --git a/build.sh b/build.sh
index b3fda8154..20ef95187 100755
--- a/build.sh
+++ b/build.sh
@@ -2,7 +2,8 @@
 ## START STANDARD SITE BUILD SCRIPT INCLUDE
 readonly THIS_SCRIPT="$(readlink -f "${BASH_SOURCE[0]}")"
 readonly BOOTSTRAP="$(dirname "$THIS_SCRIPT")/resources/bootstrap.inc.sh"
-readonly BOOTSTRAP_VERSION=v1.0.14
+BOOTSTRAP_VERSION="$(cat "$(dirname "THIS_SCRIPT")/resources/.bootstrap-required-version")" || exit 1
+readonly BOOTSTRAP_VERSION
 if ! [ -f "$BOOTSTRAP" ] || ! source "$BOOTSTRAP"; then
   curl -H "Cache-Control: no-cache" --fail --silent --show-error -w "curl: Finished attempt to download %{url}" "https://raw.githubusercontent.com/keymanapp/shared-sites/$BOOTSTRAP_VERSION/bootstrap.inc.sh" -o "$BOOTSTRAP.tmp" || exit 1
   source "$BOOTSTRAP.tmp"
diff --git a/resources/.bootstrap-required-version b/resources/.bootstrap-required-version
new file mode 100644
index 000000000..0a507609c
--- /dev/null
+++ b/resources/.bootstrap-required-version
@@ -0,0 +1 @@
+v1.0.14