diff --git a/.github/workflows/release-doxygen.yml b/.github/workflows/release-doxygen.yml
index 246d7a6304095..7bf5e5e94f905 100644
--- a/.github/workflows/release-doxygen.yml
+++ b/.github/workflows/release-doxygen.yml
@@ -34,6 +34,36 @@ on:
         required: true
 
 jobs:
+  # This job checks permissions and validates inputs to prevent potential
+  # malicious actions.  Since the release-doxygen job has contents: write
+  # permissions we need to be extra careful about who can run the job and
+  # what inputs can be provided.
+  release-doxygen-validate-input:
+    name: Release Doxygen Validate Input
+    runs-on: ubuntu-24.04
+    environment:
+      name: release
+      deployment: false
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            .github/workflows/
+
+      - name: Check Permissions
+        uses: ./.github/workflows/require-release-manager
+        with:
+          LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
+          LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
+
+      - name: Validate Input
+        ./.github/workflows/validate-release-version
+        with:
+          release-version: ${{ inputs.release-version }}
+
   release-doxygen:
     name: Build and Upload Release Doxygen
     runs-on: ubuntu-24.04
@@ -42,6 +72,8 @@ jobs:
       deployment: false
     permissions:
       contents: write
+    needs:
+      - release-doxygen-validate-input
     env:
       upload: ${{ inputs.upload && !contains(inputs.release-version, 'rc') }}
     steps:
diff --git a/.github/workflows/validate-release-version/action.yml b/.github/workflows/validate-release-version/action.yml
new file mode 100644
index 0000000000000..1a10ad67cb549
--- /dev/null
+++ b/.github/workflows/validate-release-version/action.yml
@@ -0,0 +1,15 @@
+name: Validate Release String
+description: >-
+  This checks to make sure that the given release-version string is well formed.
+inputs:
+  release-version:
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - env:
+      RELEASE_VERSON: ${{ inputs.release-version }}
+
+      run: |
+        grep -e '^[0-9]\+\.[0-9]\+\.[0-9]\+\(-rc[0-9]\+\)\?$' <<< "$RELEASE_VERSION"