diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebe88a6f..d873dfe5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,8 +34,12 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Check formatting
         run: cargo fmt --all -- --check
-      - name: Clippy
-        run: cargo clippy --workspace --all-targets --all-features
+      # Mirror the release-workflow `parity` gate exactly. Anything that
+      # would fail there must fail here so we never push a `v*` tag that
+      # the npm publish pipeline can't ship. The Release job runs with
+      # `--locked` + `-D warnings`; we do the same.
+      - name: Clippy (release-strict)
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   test:
     name: Test
@@ -48,7 +52,9 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - name: Run tests
-        run: cargo test --workspace --all-features
+        run: cargo test --workspace --all-features --locked
+      - name: Lockfile drift guard
+        run: git diff --exit-code -- Cargo.lock
       - name: Run Offline Eval Harness
         run: cargo run -p deepseek-tui --all-features -- eval