diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ab43aef..e500f77 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -66,6 +66,13 @@ jobs:
         with:
           go-version-file: go.mod
 
+      # actionlint must be on PATH so the emitted-workflow enforcement guard
+      # (TestActionlint_FeatureMatrix and the census-driven sweep) genuinely runs
+      # instead of skipping. Pinned to the same SHA the workflow-lint job uses so
+      # the guard and the repo's own workflow lint agree on the actionlint version.
+      - name: Install actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12
+
       - name: Run tests
         run: go test -v ./...
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d7161d..c8b7d98 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,14 @@ A `Migration` section is added to any release that bumps `schema_version`.
 
 ### Fixed
 
+- **ci:** The Release workflow's `Test` job now installs the SHA-pinned
+  `actionlint` binary before `go test ./...`, matching the unit-test lanes in
+  `validate.yaml` and `pr.yaml`. The emitted-workflow enforcement guard
+  hard-fails under CI when `actionlint` is absent, so a release-time test run
+  without it would fail its `Test` job and publish nothing. The install is
+  pinned to the same version the `workflow-lint` job uses, so there is no
+  version drift.
+
 - **promote:** A matrix-based promote deploy (a deploy declaring inputs) now
   threads the per-promotion environment and sha to its reusable-workflow
   callback, matching orchestrate. The matrix path previously emitted only the