diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ff70a2d93..285ab51bef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -135,6 +135,20 @@ jobs:
         run: npm run check:codeql-ratchet
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Fase 7 INT: install the advisory security scanners so the gates below
+      # actually run (they self-skip when the binaries are absent). go install
+      # uses documented module paths (no fragile version-pinned URLs); zizmor is
+      # a PyPI package. Whole job is continue-on-error, so an install hiccup never
+      # blocks the build. Exercised at the next release→main run.
+      - name: Install advisory security scanners (gitleaks/osv/actionlint/zizmor)
+        continue-on-error: true
+        run: |
+          go install github.com/rhysd/actionlint/cmd/actionlint@latest
+          go install github.com/gitleaks/gitleaks/v8@latest
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
+          echo "$HOME/go/bin" >> "$GITHUB_PATH"
+          pipx install zizmor || pip install --user zizmor
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Secret scan (gitleaks; skips if absent)
         run: npm run check:secrets
       - name: Vulnerability ratchet (osv-scanner; skips if absent)