diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 5478722..55fccb6 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -55,6 +55,7 @@ jobs:
         run: |
           .ci-venv/bin/python -m build
           .ci-venv/bin/python -m twine check dist/*
+          .ci-venv/bin/python tools/check_wheel.py
 
       - name: Publicar en Gitea PyPI
         env:
diff --git a/pyproject.toml b/pyproject.toml
index a861fdc..3e444a2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -43,6 +43,15 @@ include = [
     'tests/**/*.rst',
     'tests/**/*.json',
     ]
+exclude = [
+    '**/.ci-venv/**',
+    '**/.test-venv/**',
+    '**/.venv/**',
+    '**/__pycache__/**',
+    '**/*.py[co]',
+    'build/**',
+    'dist/**',
+    ]
 
 [tool.hatch.build.targets.wheel.sources]
 "" = "trytond/modules/ncf_manager"
diff --git a/tools/check_wheel.py b/tools/check_wheel.py
new file mode 100644
index 0000000..8084469
--- /dev/null
+++ b/tools/check_wheel.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Reject development artifacts accidentally bundled in a wheel."""
+
+from pathlib import Path
+from zipfile import ZipFile
+
+
+wheel = next(Path('dist').glob('*.whl'))
+forbidden = {'.ci-venv', '.test-venv', '.venv', '__pycache__'}
+with ZipFile(wheel) as archive:
+    invalid = [
+        name for name in archive.namelist()
+        if forbidden.intersection(Path(name).parts)
+        or name.endswith(('.pyc', '.pyo'))
+        ]
+if invalid:
+    raise SystemExit(f'Forbidden wheel content: {invalid[:10]}')
+print(f'Validated clean wheel: {wheel}')