diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index e61f16893..7b5a72f46 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -6,7 +6,7 @@ on:
       version:
         description: Debian package version
         required: true
-        default: 1.5.5+ceralive.1
+        default: 1.5.6+ceralive.1
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/runtime-package.yml b/.github/workflows/runtime-package.yml
index 40f3682ae..b59bf6e00 100644
--- a/.github/workflows/runtime-package.yml
+++ b/.github/workflows/runtime-package.yml
@@ -55,7 +55,7 @@ jobs:
                 CMAKE_CXX_COMPILER_LAUNCHER=ccache \
               packaging/build-deb.sh
               packaging/package-contract.sh
-              packaging/verify-runtime-replacement.sh dist/libsrt1.5-ceralive_1.5.5+ceralive.1_amd64.deb
+              packaging/verify-runtime-replacement.sh dist/libsrt1.5-ceralive_1.5.6+ceralive.1_amd64.deb
             '
       - name: Save ccache
         if: ${{ success() && github.event_name != 'pull_request' }}
diff --git a/packaging/build-deb.sh b/packaging/build-deb.sh
index 5f8a6991b..d94e90e43 100755
--- a/packaging/build-deb.sh
+++ b/packaging/build-deb.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 arch="${DEB_ARCH:-$(dpkg --print-architecture)}"
-version="${CERALIVE_SRT_VERSION:-1.5.5+ceralive.1}"
+version="${CERALIVE_SRT_VERSION:-1.5.6+ceralive.1}"
 triplet="$(dpkg-architecture -a "${arch}" -qDEB_HOST_MULTIARCH)"
 build_dir="${BUILD_DIR:-${root}/build-deb-${arch}}"
 stage_dir="${STAGE_DIR:-${root}/stage-deb-${arch}}"
@@ -43,7 +43,7 @@ Version: ${version}
 Architecture: ${arch}
 Maintainer: CERALIVE <contact@ceralive.tv>
 Depends: libc6 (>= 2.34), libgnutls30 (>= 3.7.9), libstdc++6 (>= 11)
-Provides: libsrt1.5-gnutls (= 1.5.5), libsrt1.5-openssl (= 1.5.5)
+Provides: libsrt1.5-gnutls (= 1.5.6), libsrt1.5-openssl (= 1.5.6)
 Conflicts: libsrt1.5-gnutls, libsrt1.5-openssl
 Replaces: libsrt1.5-gnutls, libsrt1.5-openssl
 Section: libs
diff --git a/packaging/package-contract.sh b/packaging/package-contract.sh
index ed61421c9..85d6e692e 100755
--- a/packaging/package-contract.sh
+++ b/packaging/package-contract.sh
@@ -1,13 +1,58 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Package-contract test for libsrt1.5-ceralive. Asserts the release metadata
+# statically (no build needed) so a stale version/Provides/Conflicts/Replaces or
+# a workflow default drifting behind the release is caught before publish.
+#
+# Single source of truth for the release version:
+readonly EXPECT_DEB_VERSION="1.5.6+ceralive.1"
+# The versioned virtual-package the fork provides for both Debian TLS flavors.
+# Tracks the upstream libsrt release the runtime is built from (v1.5.6).
+readonly EXPECT_TLS_VERSION="1.5.6"
+
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 builder="${root}/packaging/build-deb.sh"
+publish="${root}/.github/workflows/publish-release.yml"
+runtime="${root}/.github/workflows/runtime-package.yml"
+
+fail() { printf 'package-contract: FAIL: %s\n' "$1" >&2; exit 1; }
 
 bash -n "${builder}"
-grep -q 'USE_ENCLIB=gnutls' "${builder}"
-grep -q 'ENABLE_APPS=ON' "${builder}"
-grep -q 'ENABLE_STATIC=OFF' "${builder}"
-grep -q 'libsrt-gnutls.so.1.5' "${builder}"
-grep -q 'Provides: libsrt1.5-gnutls (= 1.5.5), libsrt1.5-openssl (= 1.5.5)' "${builder}"
-grep -q 'Conflicts: libsrt1.5-gnutls, libsrt1.5-openssl' "${builder}"
+
+# --- Single-fork build invariant (GnuTLS, shared, bundled apps) -------------
+grep -q 'USE_ENCLIB=gnutls' "${builder}"     || fail "build-deb.sh must set USE_ENCLIB=gnutls"
+grep -q 'ENABLE_APPS=ON' "${builder}"        || fail "build-deb.sh must set ENABLE_APPS=ON"
+grep -q 'ENABLE_STATIC=OFF' "${builder}"     || fail "build-deb.sh must set ENABLE_STATIC=OFF"
+grep -q 'libsrt-gnutls.so.1.5' "${builder}"  || fail "build-deb.sh must ship libsrt-gnutls.so.1.5 alias"
+
+# --- Runtime SONAME present (libsrt.so.1.5) ---------------------------------
+grep -qF 'libsrt.so.1.5' "${builder}"        || fail "build-deb.sh must reference the libsrt.so.1.5 runtime SONAME"
+
+# --- Deb version default is the current release -----------------------------
+grep -qF "version=\"\${CERALIVE_SRT_VERSION:-${EXPECT_DEB_VERSION}}\"" "${builder}" \
+	|| fail "build-deb.sh default version must be ${EXPECT_DEB_VERSION}"
+
+# --- Provides/Conflicts/Replaces for BOTH Debian TLS-flavor packages --------
+grep -qF "Provides: libsrt1.5-gnutls (= ${EXPECT_TLS_VERSION}), libsrt1.5-openssl (= ${EXPECT_TLS_VERSION})" "${builder}" \
+	|| fail "build-deb.sh Provides must declare both TLS flavors at (= ${EXPECT_TLS_VERSION})"
+grep -qF 'Conflicts: libsrt1.5-gnutls, libsrt1.5-openssl' "${builder}" \
+	|| fail "build-deb.sh Conflicts must name both TLS flavors"
+grep -qF 'Replaces: libsrt1.5-gnutls, libsrt1.5-openssl' "${builder}" \
+	|| fail "build-deb.sh Replaces must name both TLS flavors"
+
+# --- Release workflow default version tracks the release (no stale 1.5.5) ---
+grep -qF "default: ${EXPECT_DEB_VERSION}" "${publish}" \
+	|| fail "publish-release.yml version input default must be ${EXPECT_DEB_VERSION}"
+if grep -qE '1\.5\.5' "${publish}"; then
+	fail "publish-release.yml still references stale 1.5.5"
+fi
+
+# --- runtime-package.yml verify path references the current deb, not 1.5.5 ---
+grep -qF "libsrt1.5-ceralive_${EXPECT_DEB_VERSION}_amd64.deb" "${runtime}" \
+	|| fail "runtime-package.yml verify-runtime-replacement path must use ${EXPECT_DEB_VERSION}"
+if grep -qE '1\.5\.5' "${runtime}"; then
+	fail "runtime-package.yml still references stale 1.5.5"
+fi
+
+printf 'package-contract: OK (%s / Provides (= %s))\n' "${EXPECT_DEB_VERSION}" "${EXPECT_TLS_VERSION}"