diff --git a/.github/workflows/test_native.yml b/.github/workflows/test_native.yml
index bf6ece33f..f41a91199 100644
--- a/.github/workflows/test_native.yml
+++ b/.github/workflows/test_native.yml
@@ -10,11 +10,56 @@ env:
   LCOV_CAPTURE_FLAGS: --quiet --capture --include "${PWD}/src/*" --exclude '*/src/mesh/generated/*' --directory .pio/build/coverage/src --base-directory "${PWD}"
 
 jobs:
+  # Guard the registered native-suite total. `platformio test` discovers and runs whatever
+  # test_* directories exist, so it never notices when test/native-suite-count drifts from the
+  # actual directory count (a suite added without registering it, or the file left stale). That
+  # reconciliation only lives in bin/run-tests.sh, which CI does not invoke - so mirror the exact
+  # check here and fail the PR on a mismatch, keeping the manual count honest.
+  suite-count-check:
+    name: Native Suite Count
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Reconcile native-suite-count with test/ directories
+        shell: bash
+        run: |
+          set -euo pipefail
+          count_file="test/native-suite-count"
+          if [[ ! -f $count_file ]]; then
+            echo "::error title=Missing native-suite-count::$count_file not found - it must record the number of test_* suite directories."
+            exit 1
+          fi
+          # Same canonical set as bin/run-tests.sh: directories named test_* directly under test/.
+          expected_count=$(find test -maxdepth 1 -type d -name 'test_*' -printf '%f\n' | wc -l)
+          canonical_count=$(tr -d '[:space:]' <"$count_file")
+          if ! [[ $canonical_count =~ ^[0-9]+$ ]]; then
+            echo "::error title=Invalid native-suite-count::$count_file must contain a single integer, got '$canonical_count'."
+            exit 1
+          fi
+          echo "test/ directories: $expected_count"
+          echo "native-suite-count: $canonical_count"
+          if [[ $expected_count -ne $canonical_count ]]; then
+            if [[ $expected_count -gt $canonical_count ]]; then
+              hint="a suite was added - bump $count_file to $expected_count"
+            else
+              hint="a suite was removed - lower $count_file to $expected_count"
+            fi
+            echo "::error title=native-suite-count mismatch::test/ has $expected_count suite directories but $count_file says $canonical_count ($hint)."
+            exit 1
+          fi
+          echo "native-suite-count matches the $expected_count suite directories."
+
   simulator-tests:
     name: Native Simulator Tests
     runs-on: ubuntu-latest
+    needs: suite-count-check
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
@@ -87,8 +132,9 @@ jobs:
   platformio-tests:
     name: Native PlatformIO Tests
     runs-on: ubuntu-latest
+    needs: suite-count-check
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
@@ -218,7 +264,7 @@ jobs:
       - platformio-tests
     if: always()
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Get release version string
         run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT