diff --git a/.github/workflows/ci-guards.yml b/.github/workflows/ci-guards.yml
index 09e511e0a2ee..2f3eadbefdbb 100644
--- a/.github/workflows/ci-guards.yml
+++ b/.github/workflows/ci-guards.yml
@@ -439,6 +439,10 @@ jobs:
         if: ${{ matrix.group == 'release-ios' }}
         run: python3 tests/test_ios_upload_array_expansion.py
 
+      - name: Validate iOS screenshot capture fail-fast
+        if: ${{ matrix.group == 'release-ios' }}
+        run: python3 tests/test_ios_screenshot_capture_guard.py
+
       - name: Validate tagged iOS device entitlement fallback
         if: ${{ matrix.group == 'release-ios' }}
         run: node --test ios/tests/tagged-device-entitlements.test.mjs
diff --git a/scripts/ci/validate_test_execution_registry.py b/scripts/ci/validate_test_execution_registry.py
index 6cba2e1b5f40..8cf73326f4f9 100644
--- a/scripts/ci/validate_test_execution_registry.py
+++ b/scripts/ci/validate_test_execution_registry.py
@@ -36,6 +36,21 @@ def runner_lanes_from_workflow_text(text: str) -> set[str]:
     return lanes
 
 
+def all_workflow_text() -> str:
+    """Every workflow's text, for asking whether a path is executed anywhere.
+
+    A Linux guard does not have to live in ci-guards.yml to be live. The
+    always-on lanes run guards too -- testbox-broker-guard.yml deliberately has
+    no path filter, and ci-artifact-transport.yml owns its own -- so checking
+    ci-guards.yml alone rejects a test that demonstrably executes on every
+    pull request.
+    """
+    return "\n".join(
+        workflow.read_text(encoding="utf-8")
+        for workflow in sorted(WORKFLOWS.glob("*.y*ml"))
+    )
+
+
 def runner_lanes() -> set[str]:
     lanes: set[str] = set()
     for workflow in sorted(WORKFLOWS.glob("*.y*ml")):
@@ -112,14 +127,14 @@ def main(argv: list[str]) -> int:
         errors.append(f"{path}: registry entry points to a missing test")
 
     live_runner_lanes = runner_lanes()
-    guard_text = CI_GUARDS.read_text(encoding="utf-8")
+    guard_text = all_workflow_text()
     for path, entry in sorted(by_path.items()):
         lane = entry.get("lane")
         if lane in INVENTORY_LANES:
             continue
         if lane == "linux-guard":
             if path not in guard_text:
-                errors.append(f"{path}: linux-guard lane is not referenced by ci-guards.yml")
+                errors.append(f"{path}: linux-guard lane is not run by any workflow")
         elif lane not in live_runner_lanes:
             errors.append(f"{path}: lane {lane!r} has no workflow invocation")
 
diff --git a/tests/test-execution.toml b/tests/test-execution.toml
index 6fdb2f98eaaf..25c2c479e52b 100644
--- a/tests/test-execution.toml
+++ b/tests/test-execution.toml
@@ -570,6 +570,14 @@ lane = "legacy"
 path = "tests/test_check_ghostty_zig_workflows.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_ci_actionlint_covers_every_workflow.py"
+lane = "linux-guard"
+
+[[test]]
+path = "tests/test_ci_app_host_result_accounting.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_ci_cache_restore_receipt.py"
 lane = "legacy"
@@ -586,10 +594,18 @@ lane = "legacy"
 path = "tests/test_ci_release_helper_archs.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_ci_selective_layer_wiring.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_ci_ubuntu_apt_https.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_ci_workflow_guards_are_wired.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_claude_hook_missing_socket_error.py"
 lane = "legacy"
@@ -726,6 +742,14 @@ lane = "legacy"
 path = "tests/test_indexnow_notification.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_ios_screenshot_capture_guard.py"
+lane = "linux-guard"
+
+[[test]]
+path = "tests/test_ios_upload_array_expansion.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_iroh_monitor_simulator_plan.py"
 lane = "legacy"
@@ -746,6 +770,10 @@ lane = "legacy"
 path = "tests/test_memory_resource_diagnostics.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_merge_xcstrings.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_mobile_attach_prefers_iroh.py"
 lane = "legacy"
@@ -794,6 +822,10 @@ lane = "legacy"
 path = "tests/test_reconcile_entitlements_with_profile.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_release_homebrew_gate.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_reload_tag_lock.py"
 lane = "legacy"
@@ -862,6 +894,10 @@ lane = "legacy"
 path = "tests/test_tui_installers.py"
 lane = "legacy"
 
+[[test]]
+path = "tests/test_tui_publish_dispatch_budget.py"
+lane = "linux-guard"
+
 [[test]]
 path = "tests/test_tui_publish_workflow_security.py"
 lane = "legacy"