diff --git a/.github/actions/basic-checks/action.yaml b/.github/actions/basic-checks/action.yaml
index df509fd7ef2..4d2102a96e8 100644
--- a/.github/actions/basic-checks/action.yaml
+++ b/.github/actions/basic-checks/action.yaml
@@ -38,6 +38,14 @@ runs:
       shell: bash
       run: npm run build:cli
 
+    - name: Typecheck CLI + tests (strict)
+      # Explicit gate independent of the prek tsc-cli hook's file-pattern filter.
+      # The hook's `files:` scope excludes test/ and src/, which let #2130 +
+      # #2422 interact to ship a strict-mode regression onto main silently.
+      # Running this unconditionally here catches that class of drift.
+      shell: bash
+      run: npm run typecheck:cli
+
     - name: Validate config schemas
       shell: bash
       run: npm run validate:configs
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 85dee71761d..7c0cc333932 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -239,7 +239,10 @@ repos:
         entry: npx tsc -p tsconfig.cli.json
         language: system
         pass_filenames: false
-        files: ^(bin|scripts)/
+        # Match what tsconfig.cli.json actually typechecks — previously ^(bin|scripts)/
+        # missed test-only and src-only PRs, which allowed a strict-mode regression
+        # (#2130 × #2422) to land on main silently.
+        files: ^(bin/|scripts/|src/|test/|tsconfig.*\.json$)
         types_or: [ts, tsx]
         stages: [pre-push]
         priority: 10