diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b0d093..f4b3a89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,12 +57,13 @@ jobs:
             exit 0
           fi
 
-          if [ -f package-lock.json ]; then
-            npm ci
-          else
-            npm install
+          if [ ! -f package-lock.json ]; then
+            echo "package-lock.json is required for reproducible CI installs."
+            exit 1
           fi
 
+          npm ci
+
           npm run lint --if-present
           npm test --if-present
           npm run check --if-present