diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 18ba182..33d1bde 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,9 @@ jobs:
       - name: Run tests
         run: npm test
 
+      - name: Run Scorecard preflight
+        run: npm run check:scorecard
+
       - name: Build
         run: npm run build
 
diff --git a/scripts/check-scorecard.mjs b/scripts/check-scorecard.mjs
index 684e605..a2a25ec 100644
--- a/scripts/check-scorecard.mjs
+++ b/scripts/check-scorecard.mjs
@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { execFileSync } from 'node:child_process';
 
 const ROOT = process.cwd();
 const IGNORED_DIRS = new Set(['coverage', 'dist', 'node_modules']);
@@ -57,6 +58,15 @@ addCheck('Committed npm lockfile exists', () => {
   if (!fs.existsSync(lockfile)) {
     throw new Error('package-lock.json is required for reproducible dependency resolution');
   }
+
+  try {
+    execFileSync('git', ['ls-files', '--error-unmatch', 'package-lock.json'], {
+      cwd: ROOT,
+      stdio: 'ignore',
+    });
+  } catch {
+    throw new Error('package-lock.json must be tracked by Git');
+  }
 });
 
 addCheck('Release workflow includes artifact attestation', () => {