diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5cb69cd..159ff298 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,6 +41,9 @@ jobs:
 
       - name: Install local package
         run: python -m pip install --no-deps -e .
+
+      - name: Check installed dependency consistency
+        run: python -m pip check
 
       - name: Security scan
         # bandit and pip-audit are already in the dev extra above, so the
@@ -90,6 +93,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       # AGT 4.1 currently constrains cryptography below 49, while the runtime
       # requires 50+ for published security fixes. Keep the scanner isolated
       # so its tooling constraints cannot downgrade the package under test,
@@ -143,6 +149,9 @@ jobs:
 
       - name: Install local package
         run: python -m pip install --no-deps -e .
+
+      - name: Check installed dependency consistency
+        run: python -m pip check
 
       - name: Run benchmark (software-only, CI gate p99 < 5ms)
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/
diff --git a/.github/workflows/release-validation.yml b/.github/workflows/release-validation.yml
index dc9cf8d9..3f6ddc62 100644
--- a/.github/workflows/release-validation.yml
+++ b/.github/workflows/release-validation.yml
@@ -32,6 +32,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       - name: Security scan
         # bandit and pip-audit are already in the dev extra above, so the
         # scan runs against the same pinned versions rather than fetching
@@ -73,6 +76,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       # AGT 4.1 currently constrains cryptography below 49, while the runtime
       # requires 50+ for published security fixes. Keep the scanner isolated
       # so its tooling constraints cannot downgrade the package under test,
@@ -127,6 +133,9 @@ jobs:
       - name: Install local package
         run: python -m pip install --no-deps -e .
 
+      - name: Check installed dependency consistency
+        run: python -m pip check
+
       - name: Run benchmark (software-only, CI gate p99 < 5ms)
         run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/