diff --git a/.gitea/workflows/release-integration.yml b/.gitea/workflows/release-integration.yml
index ae92e01..cb7225a 100644
--- a/.gitea/workflows/release-integration.yml
+++ b/.gitea/workflows/release-integration.yml
@@ -29,6 +29,7 @@ jobs:
           python -m venv .venv
           .venv/bin/python tools/repo/sync-python-environment.py --requirements requirements-release.txt --python .venv/bin/python --upgrade-pip
           .venv/bin/python -m pip install '../govoplan-core[dev]'
+          .venv/bin/python -m pip install -r requirements-release-tests.txt
       - name: Install WebUI release dependencies
         working-directory: govoplan
         run: bash tools/release/install-webui-release-dependencies.sh ../govoplan-core/webui
diff --git a/docs/MODULE_CONTRACTS_AND_INSTALLS.md b/docs/MODULE_CONTRACTS_AND_INSTALLS.md
index 2fc9d65..be0d2eb 100644
--- a/docs/MODULE_CONTRACTS_AND_INSTALLS.md
+++ b/docs/MODULE_CONTRACTS_AND_INSTALLS.md
@@ -114,7 +114,10 @@ For release validation:
 
 ```sh
 ./.venv/bin/python tools/repo/sync-python-environment.py --requirements requirements-release.txt --python ./.venv/bin/python
+./.venv/bin/python -m pip install -r requirements-release-tests.txt
 ```
 
 That install is necessary because the release environment intentionally resolves
-tagged package refs, not local editable source trees.
+tagged package refs, not local editable source trees. The second requirements
+file contains only the harness needed to execute tests from those immutable
+source tags; it is not part of the deployable release dependency set.
diff --git a/requirements-release-tests.txt b/requirements-release-tests.txt
new file mode 100644
index 0000000..74f3cdf
--- /dev/null
+++ b/requirements-release-tests.txt
@@ -0,0 +1,4 @@
+# Test-harness dependencies used against immutable release source tags.
+# Keep these separate from requirements-release.txt so they are not part of the
+# deployable product dependency set.
+pytest>=8,<9
diff --git a/tests/test_release_integration.py b/tests/test_release_integration.py
index 6170ff5..f637b3d 100644
--- a/tests/test_release_integration.py
+++ b/tests/test_release_integration.py
@@ -103,6 +103,18 @@ class ReleaseIntegrationTests(unittest.TestCase):
         self.assertIn('--core-root "$ROOT"', script)
         self.assertNotIn('"$PYTHON" -m unittest tests.test_module_system', script)
 
+    def test_release_workflow_installs_tagged_source_test_harness(self) -> None:
+        meta_root = Path(__file__).resolve().parents[1]
+        workflow = (meta_root / ".gitea" / "workflows" / "release-integration.yml").read_text(encoding="utf-8")
+        requirements = (meta_root / "requirements-release-tests.txt").read_text(encoding="utf-8")
+
+        install = workflow.index("pip install -r requirements-release-tests.txt")
+        checks = workflow.index("bash tools/checks/check-release-integration.sh")
+
+        self.assertLess(install, checks)
+        self.assertIn("pytest>=8,<9", requirements)
+        self.assertNotIn("requirements-release-tests.txt", (meta_root / "requirements-release.txt").read_text(encoding="utf-8"))
+
 
 if __name__ == "__main__":
     unittest.main()