diff --git a/codebuild/release/prod-release.yml b/codebuild/release/prod-release.yml
index 63db04621..aa985e361 100644
--- a/codebuild/release/prod-release.yml
+++ b/codebuild/release/prod-release.yml
@@ -9,21 +9,33 @@ env:
 
 phases:
   install:
+    commands:
+      - pip install tox
+      - pip install --upgrade pip
     runtime-versions:
       python: latest
+  pre_build:
+    commands:
+      - git checkout $COMMIT_ID
+      - FOUND_VERSION=$(sed -n 's/__version__ = "\(.*\)"/\1/p' src/aws_encryption_sdk/identifiers.py)
+      - |
+        if expr ${FOUND_VERSION} != ${VERSION}; then
+          echo "identifiers.py version (${FOUND_VERSION}) does not match expected version (${VERSION}), stopping"
+          exit 1;
+        fi
   build:
     commands:
-      - pip install tox
-      - git checkout $BRANCH
       - tox -e park
       - tox -e release
-      - git clone https://github.com/aws-samples/busy-engineers-document-bucket.git
-      - cd busy-engineers-document-bucket/exercises/python/encryption-context-complete
-      - sed -i "s/aws_encryption_sdk/aws_encryption_sdk==$VERSION/" requirements-dev.txt
-      - tox -e test
-
 
 batch:
-  fast-fail: false
-  build-list:
-    - identifier: prod_release
+  fast-fail: true 
+  build-graph:
+    - identifier: release_to_prod
+    - identifier: validate_prod_release
+      depend-on:
+        - release_to_prod
+      buildspec: codebuild/release/validate.yml
+      env:
+        variables:
+          PIP_INDEX_URL: https://pypi.python.org/simple/
diff --git a/codebuild/release/test-release.yml b/codebuild/release/test-release.yml
index 8189050b2..6c0ce85c9 100644
--- a/codebuild/release/test-release.yml
+++ b/codebuild/release/test-release.yml
@@ -9,17 +9,35 @@ env:
 
 phases:
   install:
+    commands:
+      - pip install tox
+      - pip install --upgrade pip
     runtime-versions:
       python: latest
+  pre_build:
+    commands:
+      - git checkout $COMMIT_ID
+      - FOUND_VERSION=$(sed -n 's/__version__ = "\(.*\)"/\1/p' src/aws_encryption_sdk/identifiers.py)
+      - |
+        if expr ${FOUND_VERSION} != ${VERSION}; then
+          echo "identifiers.py version (${FOUND_VERSION}) does not match expected version (${VERSION}), stopping"
+          exit 1;
+        fi
   build:
     commands:
-      - pip install tox
-      - git checkout $BRANCH
       - tox -e park
       - tox -e test-release
 
 
 batch:
-  fast-fail: false
-  build-list:
-    - identifier: test_release
+  fast-fail: true
+  build-graph:
+    - identifier: release_to_staging
+    - identifier: validate_staging_release
+      depend-on:
+        - release_to_staging
+      buildspec: codebuild/release/validate.yml
+      env:
+        variables:
+          PIP_INDEX_URL: https://test.pypi.org/simple/
+          PIP_EXTRA_INDEX_URL: https://pypi.python.org/simple/
diff --git a/codebuild/release/validate.yml b/codebuild/release/validate.yml
new file mode 100644
index 000000000..1f65c0631
--- /dev/null
+++ b/codebuild/release/validate.yml
@@ -0,0 +1,16 @@
+version: 0.2
+
+phases:
+  install:
+    commands:
+      - pip install tox
+    runtime-versions:
+      python: latest
+  pre_build:
+    commands:
+      - git clone https://github.com/aws-samples/busy-engineers-document-bucket.git
+      - cd busy-engineers-document-bucket/exercises/python/encryption-context-complete
+      - sed -i "s/aws_encryption_sdk/aws_encryption_sdk==$VERSION/" requirements-dev.txt
+  build:
+    commands:
+      - tox -e test