diff --git a/.github/actions/devcontainer-json/action.sh b/.github/actions/devcontainer-json/action.sh
index c769c34c9..b58846d42 100755
--- a/.github/actions/devcontainer-json/action.sh
+++ b/.github/actions/devcontainer-json/action.sh
@@ -1,13 +1,17 @@
 #! /usr/bin/env bash
 
 # cd to the repo root
-cd "$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )/../../../";
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "${script_dir}/../../../" || exit 1
 
 os="${1:-"ubuntu:22.04"}";
 features="${2:-"[]"}";
 container_env="${3:-"null"}";
 
-VERSION="$(git describe --abbrev=0 --tags --first-parent | sed 's/[a-zA-Z]//g' | cut -d '.' -f -2)";
+# VERSION is updated before the alpha tag is created during release rollover.
+# Use it as the source of truth so a release workflow triggered by that update
+# publishes the new image namespace instead of the previous tagged version.
+VERSION="$(cut -d '.' -f 1-2 VERSION)";
 tag="$(node -p "$(cat <<EOF
 ['cpp', ...${features}.filter((x) => !x.hide).map(({ name = '', version = '', suffix = '' }) => {
     if (name.includes(':')) {
diff --git a/.github/workflows/build-test-and-push-windows-image.yml b/.github/workflows/build-test-and-push-windows-image.yml
index 368016d38..895d3eb3d 100644
--- a/.github/workflows/build-test-and-push-windows-image.yml
+++ b/.github/workflows/build-test-and-push-windows-image.yml
@@ -54,7 +54,9 @@ jobs:
           repo="$INPUT_REPO";
           cl="$(echo "$INPUT_FEATURES" | jq -r '.[1].version')";
           cuda="$(echo "$INPUT_FEATURES" | jq -r '.[0].version')";
-          version="$(git describe --abbrev=0 --tags --first-parent | sed 's/[a-zA-Z]//g' | cut -d '.' -f -2)";
+          # VERSION changes before the alpha tag exists during release rollover.
+          # Reading it directly keeps producer tags aligned with their consumers.
+          version="$(cut -d '.' -f 1-2 VERSION)";
           base_tag="cuda${cuda}-cl${cl}";
           tag_without_os="${version}-${base_tag}";
           cat <<EOF | tee "$GITHUB_OUTPUT"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6723a970c..15e551161 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -84,10 +84,25 @@ jobs:
           scenarios: "${{ needs.features-matrix.outputs.scenarios }}"
           full_matrix: "${{ github.event_name == 'workflow_dispatch' && 'true' || 'false' }}"
 
+  validate-devcontainer-bases:
+    name: Validate devcontainer base images
+    needs: check-event
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout ${{ github.repository }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Validate unified devcontainer bases
+        run: ci/validate-devcontainer-bases.sh
+
   release-linux:
     if: needs.image-matrix.outputs.linux != '{"include":[]}'
     name: ${{ matrix.name || 'Linux' }}
-    needs: image-matrix
+    needs: [image-matrix, validate-devcontainer-bases]
     permissions:
       contents: read
     secrets: inherit  # zizmor: ignore[secrets-inherit]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2750c9a68..efee6b342 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -43,6 +43,20 @@ jobs:
       - name: Run pre-commit
         run: pip install pre-commit && pre-commit run --all-files
 
+  shellcheck:
+    name: ShellCheck
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout ${{ github.repository }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run ShellCheck
+        run: shellcheck .github/actions/devcontainer-json/action.sh ci/validate-devcontainer-bases.sh
+
   build-all-rapids-repos:
     if: needs.check-event.outputs.ok == 'true' && github.repository_owner == 'rapidsai'
     name: Build
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c3260a0cd..81ac52152 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,3 +4,10 @@ repos:
     rev: v1.25.2
     hooks:
       - id: zizmor
+  - repo: local
+    hooks:
+      - id: validate-devcontainer-bases
+        name: validate devcontainer base images
+        entry: ci/validate-devcontainer-bases.sh
+        language: system
+        pass_filenames: false
diff --git a/ci/validate-devcontainer-bases.sh b/ci/validate-devcontainer-bases.sh
new file mode 100755
index 000000000..982705581
--- /dev/null
+++ b/ci/validate-devcontainer-bases.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+full_version="$(tr -d '[:space:]' < VERSION)"
+if [[ ! "${full_version}" =~ ^[0-9]{2}\.[0-9]{2}\.[0-9]{2}$ ]]; then
+  echo "VERSION must use YY.MM.PP format; found '${full_version}'" >&2
+  exit 1
+fi
+short_version="${full_version%.*}"
+
+expected_tags="$(mktemp)"
+trap 'rm -f "${expected_tags}"' EXIT
+
+# Recreate the visible part of every Linux image name from matrix.yml. Hidden
+# features affect image contents but, by design, do not appear in image tags.
+yq --yaml-fix-merge-anchor-to-spec -eMo json matrix.yml \
+  | jq -r --arg version "${short_version}" '
+      .include[]
+      | select(.os != "windows")
+      | (.os | gsub(":"; "")) as $os
+      | .images[]
+      | (.features
+          | map(
+              select(.hide != true)
+              | (.name | split("/")[-1] | split(":")[0])
+                + (.version // "" | tostring)
+                + (.suffix // "" | tostring)
+            )
+          | (. + [$os])
+          | join("-")
+        ) as $name
+      # The release publishes both the OS-qualified tag and an OS-free alias.
+      | [
+          $version + "-cpp-" + $name,
+          $version + "-cpp-" + ($name | sub("-" + $os + "$"; ""))
+        ]
+      | .[]
+    ' \
+  | sort -u > "${expected_tags}"
+
+status=0
+while IFS=$'\t' read -r file base; do
+  [[ "${base}" == rapidsai/devcontainers:* ]] || continue
+  tag="${base#rapidsai/devcontainers:}"
+  if ! grep -Fqx -- "${tag}" "${expected_tags}"; then
+    echo "${file}: BASE '${base}' is not produced by matrix.yml" >&2
+    status=1
+  fi
+done < <(
+  find .devcontainer -name devcontainer.json -exec \
+    jq -r '[input_filename, (.build.args.BASE // "")] | @tsv' {} +
+)
+
+exit "${status}"