diff --git a/.github/actions/check-go-mod-replace/action.yml b/.github/actions/check-go-mod-replace/action.yml
new file mode 100644
index 0000000000..63c37ef837
--- /dev/null
+++ b/.github/actions/check-go-mod-replace/action.yml
@@ -0,0 +1,47 @@
+# Copyright 2026 The kpt Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Check go.mod replace directives
+description: >
+  Fails if the go.mod in the specified directory contains active replace
+  directives that are not in the allowed list.
+
+inputs:
+  working-directory:
+    description: Directory containing the go.mod to check.
+    required: false
+    default: "."
+  allowed-replacements:
+    description: >
+      JSON array of module paths that are allowed to have replace directives.
+      Example: '["k8s.io/apiserver", "sigs.k8s.io/kustomize/kyaml"]'
+    required: false
+    default: "[]"
+
+runs:
+  using: composite
+  steps:
+    - name: Check for replace directives
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        ALLOWED='${{ inputs.allowed-replacements }}'
+        UNEXPECTED=$(go mod edit -json | jq --argjson allowed "$ALLOWED" \
+          '[(.Replace // [])[] | select(.Old.Path as $p | $allowed | index($p) | not)]')
+        COUNT=$(echo "$UNEXPECTED" | jq 'length')
+        if [ "$COUNT" -gt 0 ]; then
+          echo "::error::$(pwd)/go.mod contains unexpected replace directives. Remove them before releasing."
+          echo "$UNEXPECTED" | jq .
+          exit 1
+        fi
diff --git a/.github/workflows/release-api.yml b/.github/workflows/release-api.yml
index 7f3e790bb3..6bcbddf1d7 100644
--- a/.github/workflows/release-api.yml
+++ b/.github/workflows/release-api.yml
@@ -32,6 +32,10 @@ jobs:
         with:
           go-version-file: api/go.mod
           cache-dependency-path: api/go.sum
+      - name: Check for replace directives in api/go.mod
+        uses: ./.github/actions/check-go-mod-replace
+        with:
+          working-directory: api
       - name: Build, test, lint (api module)
         run: |
           git config --global user.email you@example.com
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eef849ff05..5e8f7c04db 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,8 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
+      - name: Check for replace directives in go.mod
+        uses: ./.github/actions/check-go-mod-replace
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx