diff --git a/.github/workflows/validate-milestone.yml b/.github/workflows/validate-milestone.yml
new file mode 100644
index 000000000000..c76f43e8b14c
--- /dev/null
+++ b/.github/workflows/validate-milestone.yml
@@ -0,0 +1,35 @@
+name: validate-milestone
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, synchronize, milestoned, demilestoned, edited]
+
+jobs:
+  validate-milestone:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: VERSION
+
+      - name: Validate milestone matches VERSION
+        run: |
+          expected=$(cat VERSION)
+          milestone="${{ github.event.pull_request.milestone.title }}"
+
+          if [[ -z "$milestone" ]]; then
+            echo "::error::PR must have a milestone set (expected: $expected)"
+            exit 1
+          fi
+
+          if [[ "$milestone" != "$expected" ]]; then
+            echo "::error::Milestone '$milestone' does not match VERSION '$expected'"
+            exit 1
+          fi
+
+          echo "Milestone: $milestone ✓"
diff --git a/VERSION b/VERSION
index 634872d67b65..32d331ac3857 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-29.4.0-dev
+29.4.1
diff --git a/docker.Makefile b/docker.Makefile
index e4ffd9e5181f..ce0cbd533d6c 100644
--- a/docker.Makefile
+++ b/docker.Makefile
@@ -19,7 +19,7 @@ CACHE_VOLUME_NAME := docker-cli-dev-cache
 ifeq ($(DOCKER_CLI_GO_BUILD_CACHE),y)
 DOCKER_CLI_MOUNTS += -v "$(CACHE_VOLUME_NAME):/root/.cache/go-build"
 endif
-VERSION = $(shell cat VERSION)
+VERSION ?= $(shell cat VERSION)-dev
 ENVVARS = -e VERSION=$(VERSION) -e GITCOMMIT -e PLATFORM -e TESTFLAGS -e TESTDIRS -e GOOS -e GOARCH -e GOARM -e ENGINE_VERSION
 
 # Some Dockerfiles use features that are only supported with BuildKit enabled