diff --git a/build-aux/build-debs.sh b/build-aux/build-debs.sh
index f65cd2be3c..e10ab989f9 100644
--- a/build-aux/build-debs.sh
+++ b/build-aux/build-debs.sh
@@ -40,6 +40,15 @@ printf '%s\n' "1:${OVN_BASE}-pf9-${PF9_VERSION}-${BUILD_NUMBER}" > $TEAMCITY_ROO
 # configure.ac gets the dot-separated binary version via pf9_patch_ovn_binary_version
 sed -i "s/__PF9_OVN_BUILD_VERSION__/$PF9_OVN_BUILD_VERSION/g" "$ROOT/debian/changelog"
 
+# dpkg-buildpackage only reads the TOPMOST changelog entry. An upstream rebase can
+# prepend a new "ovn (X.Y.Z-1)" entry above ours, silently shipping unversioned debs.
+ACTUAL_VER=$(cd "$ROOT" && dpkg-parsechangelog -S Version)
+if [ "$ACTUAL_VER" != "$PF9_OVN_BUILD_VERSION" ]; then
+    echo "ERROR: top debian/changelog entry is '$ACTUAL_VER', expected '$PF9_OVN_BUILD_VERSION'."
+    echo "The Platform9 changelog entry must be the topmost entry in debian/changelog."
+    exit 1
+fi
+
 pf9_patch_ovn_binary_version
 
 # --- OVS CONFIGURATION ---
diff --git a/debian/changelog b/debian/changelog
index adb53e603a..65877291f4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,3 @@
-ovn (25.09.4-1) unstable; urgency=low
-   [ OVN team ]
-   * New upstream version
-
- -- OVN team <dev@openvswitch.org>  Tue, 16 Jun 2026 12:11:30 -0400
-
 ovn (__PF9_OVN_BUILD_VERSION__) unstable; urgency=medium
    [ Platform9 Systems ]
    * ovn-northd: added changes to support l2 only ports
@@ -11,6 +5,12 @@ ovn (__PF9_OVN_BUILD_VERSION__) unstable; urgency=medium
 
  -- Platform9 Systems <info@platform9.com>  Tue, 16 Dec 2025 22:00:00 -0800
 
+ovn (25.09.4-1) unstable; urgency=low
+   [ OVN team ]
+   * New upstream version
+
+ -- OVN team <dev@openvswitch.org>  Tue, 16 Jun 2026 12:11:30 -0400
+
 ovn (25.09.3-1) unstable; urgency=low
    [ OVN team ]
    * New upstream version