diff --git a/.github/scripts/test_release_promotion.sh b/.github/scripts/test_release_promotion.sh
index 44462df0..65d558ec 100755
--- a/.github/scripts/test_release_promotion.sh
+++ b/.github/scripts/test_release_promotion.sh
@@ -253,6 +253,21 @@ must_reject_verify sbom-predicate
 must_reject_verify sbom-subject
 must_reject_verify malformed-output
 
+must_reject_promoted() {
+  local tamper=$1
+  if MOCK_TAMPER=$tamper "$attestation" verify-promoted \
+    "$identity" "$source_uri" "$source_ref" "$commit" "$builder" "$invocation" \
+    "${promotion_targets[@]}" > /dev/null 2>&1; then
+    echo "Promotion verify accepted $tamper attestation output" >&2
+    exit 1
+  fi
+}
+must_reject_promoted builder
+must_reject_promoted invocation
+must_reject_promoted sbom-predicate
+must_reject_promoted sbom-subject
+must_reject_promoted malformed-output
+
 if "$attestation" verify-images "https://github.com/owner/other/.github/workflows/ci.yml@refs/tags/v1.2.3" \
   "$source_uri" "$source_ref" "$commit" "$builder" "$invocation" "$gochat" > /dev/null 2>&1; then
   echo "Production verify accepted wrong certificate identity" >&2