diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 81c3791..c96e7c6 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -13,6 +13,8 @@ jobs:
           version: 9.15.9
       - name: Install
         run: pnpm install --frozen-lockfile
+      - name: Canonical architecture policy
+        run: pnpm run validate:architecture
       - name: Typecheck
         run: pnpm run typecheck
       - name: Test
@@ -39,5 +41,7 @@ jobs:
           version: 9.15.9
       - name: Install
         run: pnpm install --frozen-lockfile
-      - name: Check schema/contracts
+      - name: Canonical architecture policy
+        run: pnpm run validate:architecture
+      - name: Check schema/contracts and provenance policy
         run: pnpm --filter @siax/c0py-core test