diff --git a/.github/workflows/client-v1-conformance.yml b/.github/workflows/client-v1-conformance.yml
index f6c2328..e48abe4 100644
--- a/.github/workflows/client-v1-conformance.yml
+++ b/.github/workflows/client-v1-conformance.yml
@@ -30,6 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
+          fetch-depth: 0
           persist-credentials: false
           ref: ${{ github.sha }}
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
diff --git a/src/specification-guards.test.ts b/src/specification-guards.test.ts
index a7abfc9..e0bc57c 100644
--- a/src/specification-guards.test.ts
+++ b/src/specification-guards.test.ts
@@ -352,6 +352,14 @@ describe('Phase 1 specification guards', () => {
     expect(webJob).toContain('- run: pnpm test:unit');
   });
 
+  it('fetches the locked harness revision for protected platform evidence', () => {
+    const workflow = readText('.github/workflows/client-v1-conformance.yml');
+
+    expect(workflow).toMatch(
+      /actions\/checkout@[0-9a-f]{40}\n {8}with:\n {10}fetch-depth: 0\n {10}persist-credentials: false\n {10}ref: \$\{\{ github\.sha \}\}/u,
+    );
+  });
+
   it('uses a POSIX shell fixture without exposing Node internal descriptors to status forgery', () => {
     const testSource = readText('src/phase1-conformance.test.ts');
     const start = testSource.indexOf(