diff --git a/.github/workflows/docker-build-publish.yml b/.github/workflows/docker-build-publish.yml
index dc1e405..3af21c9 100644
--- a/.github/workflows/docker-build-publish.yml
+++ b/.github/workflows/docker-build-publish.yml
@@ -103,6 +103,15 @@ jobs:
         run: |
           set -euo pipefail
 
+          if ! echo "$IMAGES" | jq -e . >/dev/null; then
+            echo "inputs.images must be valid JSON" >&2
+            exit 1
+          fi
+          if ! echo "$IMAGES" | jq -e 'type == "array"' >/dev/null; then
+            echo "inputs.images must be a JSON array" >&2
+            exit 1
+          fi
+
           SSH_FLAGS=()
           if [ -n "${SSH_AUTH_SOCK:-}" ]; then
             SSH_FLAGS+=(--ssh default)