diff --git a/.github/workflows/dotnet-cd.yml b/.github/workflows/dotnet-cd.yml
index 243d0b4..d882900 100644
--- a/.github/workflows/dotnet-cd.yml
+++ b/.github/workflows/dotnet-cd.yml
@@ -25,6 +25,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Verify tag commit is reachable from master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "❌ Error: Tag commit ${{ github.sha }} is not reachable from origin/master"
+            echo "Ensure the PR is merged to master before pushing a release tag"
+            exit 1
+          fi
+          echo "✅ Verified: commit is reachable from master"
+
       - name: Extract version from tag
         id: version
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 981d60b..f5aa253 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -52,6 +52,8 @@ This project uses famous football stadiums (A-Z) that hosted FIFA World Cup matc
 
 ### Changed
 
+- Add "Verify tag commit is reachable from master" step to CD workflow using `git merge-base --is-ancestor` before any build or publish steps (#439)
+
 ### Fixed
 
 - `GET /players` now returns `200 OK` with an empty list `[]` when no players exist, instead of `404 Not Found` (#425)