diff --git a/.github/workflows/cf06-oracle.yml b/.github/workflows/cf06-oracle.yml
index d4a34854..cd5c0b89 100644
--- a/.github/workflows/cf06-oracle.yml
+++ b/.github/workflows/cf06-oracle.yml
@@ -10,15 +10,18 @@ permissions:
   contents: read
 
 jobs:
-  oracle-adapter:
+  oracle-self-smoke:
+    name: oracle-self-smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v5.7.0
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 / Node 24
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: '17'
-      - uses: dtolnay/rust-toolchain@1.97.1
+      - uses: dtolnay/rust-toolchain@032958afbdc797a9164d3bc0b56325c1308924a5 # 1.97.1
       - name: Build pinned HL7 oracle adapter
         run: mvn -B -ntp -f tools/hl7-oracle/pom.xml package
       - name: Resolve pinned real R4 oracle context
@@ -88,6 +91,26 @@ jobs:
           assert report['structural_diff']['changes'] == []
           assert report['resources'] == []
           PY
+
+  oracle-changed-profile:
+    name: oracle-changed-profile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 / Node 24
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: '17'
+      - uses: dtolnay/rust-toolchain@032958afbdc797a9164d3bc0b56325c1308924a5 # 1.97.1
+      - name: Build pinned HL7 oracle adapter
+        run: mvn -B -ntp -f tools/hl7-oracle/pom.xml package
+      - name: Resolve pinned real R4 oracle context
+        run: |
+          rm -rf /tmp/commandf-oracle-smoke
+          cargo run --locked --quiet -p commandf -- pkg resolve hl7.fhir.r4.core@4.0.1 --cache /tmp/commandf-oracle-smoke/cache --lock /tmp/commandf-oracle-smoke/commandf.lock
+          cargo run --locked --quiet -p commandf -- pkg verify --cache /tmp/commandf-oracle-smoke/cache --lock /tmp/commandf-oracle-smoke/commandf.lock
       - name: Build deterministic changed-profile oracle fixtures
         run: |
           ARCHIVE="$(python - <<'PY'
@@ -247,3 +270,20 @@ jobs:
           fields = {change.get('field') for change in report['structural_diff']['changes']}
           assert {'min', 'type', 'binding', 'mustSupport'} <= fields
           PY
+
+  oracle-proof:
+    name: oracle-proof
+    if: always()
+    needs:
+      - oracle-self-smoke
+      - oracle-changed-profile
+    runs-on: ubuntu-latest
+    steps:
+      - name: Enforce all CF-06 oracle validation suites
+        env:
+          SELF_SMOKE_RESULT: ${{ needs.oracle-self-smoke.result }}
+          CHANGED_PROFILE_RESULT: ${{ needs.oracle-changed-profile.result }}
+        run: |
+          set -euo pipefail
+          test "$SELF_SMOKE_RESULT" = success
+          test "$CHANGED_PROFILE_RESULT" = success