diff --git a/.github/workflows/trybot.yaml b/.github/workflows/trybot.yaml
index 3f73a35f4..871701b2c 100644
--- a/.github/workflows/trybot.yaml
+++ b/.github/workflows/trybot.yaml
@@ -148,11 +148,27 @@ jobs:
           cd internal/_e2e
           go test -race
       - if: (matrix.go-version == '1.23.x' && matrix.runner == 'ubuntu-22.04')
-        name: Check
+        name: Go checks
         run: |-
           go vet ./...
           go mod tidy
           (cd internal/_e2e && go test -run=-)
+      - if: (matrix.go-version == '1.23.x' && matrix.runner == 'ubuntu-22.04')
+        name: Check all git tags are available
+        run: |-
+          cd $(mktemp -d)
+
+          git ls-remote --tags https://github.com/cue-lang/cue >github.txt
+          echo "GitHub tags:"
+          sed 's/^/    /' github.txt
+
+          git ls-remote --tags https://review.gerrithub.io/cue-lang/cue >gerrit.txt
+
+          if ! diff -u github.txt gerrit.txt; then
+          	echo "GitHub and Gerrit do not agree on the list of tags!"
+          	echo "Did you forget about refs/attic branches? https://github.com/cue-lang/cue/wiki/Notes-for-project-maintainers"
+          	exit 1
+          fi
       - name: Check that git is clean at the end of the job
         if: always()
         run: test -z "$(git status --porcelain)" || (git status; git diff; false)
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index cf51a63bf..858a655c0 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -77,6 +77,7 @@ workflows: trybot: _repo.bashWorkflow & {
 				_goTestWasm,
 				for v in _e2eTestSteps {v},
 				_goCheck,
+				_checkTags,
 				_repo.checkGitClean,
 			]
 		}
@@ -167,7 +168,7 @@ workflows: trybot: _repo.bashWorkflow & {
 		//
 		// TODO: consider adding more checks as per https://github.com/golang/go/issues/42119.
 		if:   "\(_isLatestLinux)"
-		name: "Check"
+		name: "Go checks"
 		run: """
 			go vet ./...
 			go mod tidy
@@ -175,6 +176,32 @@ workflows: trybot: _repo.bashWorkflow & {
 			"""
 	}
 
+	_checkTags: json.#step & {
+		// Ensure that GitHub and Gerrit agree on the full list of available tags.
+		// This way, if there is any discrepancy, we will get a useful go-cmp diff.
+		//
+		// We use `git ls-remote` to list all tags from each remote git repository
+		// because it does not depend on custom REST API endpoints and is very fast.
+		// Note that it sorts tag names as strings, which is not the best, but works OK.
+		if:   "\(_isLatestLinux)"
+		name: "Check all git tags are available"
+		run: """
+			cd $(mktemp -d)
+
+			git ls-remote --tags https://github.com/cue-lang/cue >github.txt
+			echo "GitHub tags:"
+			sed 's/^/    /' github.txt
+
+			git ls-remote --tags https://review.gerrithub.io/cue-lang/cue >gerrit.txt
+
+			if ! diff -u github.txt gerrit.txt; then
+				echo "GitHub and Gerrit do not agree on the list of tags!"
+				echo "Did you forget about refs/attic branches? https://github.com/cue-lang/cue/wiki/Notes-for-project-maintainers"
+				exit 1
+			fi
+			"""
+	}
+
 	_goTestRace: json.#step & {
 		name: "Test with -race"
 		env: GORACE: "atexit_sleep_ms=10" // Otherwise every Go package being tested sleeps for 1s; see https://go.dev/issues/20364.