diff --git a/.buildkite/tag.sh b/.buildkite/tag.sh
index 8b2c6782..bfaed965 100755
--- a/.buildkite/tag.sh
+++ b/.buildkite/tag.sh
@@ -8,17 +8,17 @@ set -euo pipefail
 
 TAG="$(buildkite-agent meta-data get "release-tag")"
 
-echo "--- Verifying tag ${TAG}"
-echo "Remote tags:"
-git ls-remote --tags
-echo "Local tags:"
-git tag -l
-# TODO verify the tag format and that its semver newer than the most previous
+if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
+  echo "Error: Tag ${TAG} already exists at origin"
+  exit 1
+fi
+
+echo "${TAG} does not exist at origin. Proceeding... 🚀"
 
 echo "--- Downloading gh"
-curl -sL https://github.com/cli/cli/releases/download/v2.51.0/gh_2.51.0_linux_amd64.tar.gz | tar xz
+curl -sL https://github.com/cli/cli/releases/download/v2.57.0/gh_2.57.0_linux_amd64.tar.gz | tar xz
 echo "--- Logging in to gh"
-gh_2.51.0_linux_amd64/bin/gh auth setup-git
+gh_2.57.0_linux_amd64/bin/gh auth setup-git
 
 echo "+++ Tagging ${BUILDKITE_COMMIT} with ${TAG}"
 git tag "${TAG}"