diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f055931..b03b548 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -22,6 +22,31 @@ unit-tests:
   script:
     - export JAVA_HOME=/opt/homebrew/opt/openjdk@21
     - export ANDROID_HOME=$HOME/Library/Android/sdk
+    # 🔴 **The protocol vectors are not in this repo, and CI never had them.**
+    # `AccountKdfTest`, `PQVectorTest` and `PublishedVectorsTest` look for a
+    # sibling `flamenet-e2e` checkout. That exists on a developer's machine and
+    # has never existed in a build directory, so all twenty of them have been
+    # failing here since they were written — invisibly, because the build cache
+    # replayed a local pass. They fail rather than skip when the file is
+    # missing, exactly so this could not hide; it took `--rerun-tasks` to let
+    # them say so.
+    #
+    # ⚠️ Cloned at its tip rather than pinned. These vectors are normative and
+    # shared with iOS: if the published protocol changes, this suite SHOULD go
+    # red without a commit here, because that is a real divergence and not a
+    # stale pin. `flamenet-e2e` is public, so no credentials are needed.
+    - rm -rf "$CI_PROJECT_DIR/.ci-vectors"
+    - git clone --depth 1 https://gitlab.com/paulhitt/flamenet-e2e.git "$CI_PROJECT_DIR/.ci-vectors"
+    - export FLAMENET_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/protocol-v1.json"
+    - export FLAMENET_PQ_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/pqx3dh-v2.json"
+    - export FLAMENET_ACCOUNT_VECTORS="$CI_PROJECT_DIR/.ci-vectors/test/vectors/account-kdf-v1.json"
+    # ⚠️ Checked before the suite runs. A path that silently does not exist puts
+    # the tests straight back where they were, and the failure would read as a
+    # protocol bug rather than a missing file.
+    - |
+      for f in "$FLAMENET_VECTORS" "$FLAMENET_PQ_VECTORS" "$FLAMENET_ACCOUNT_VECTORS"; do
+        [ -f "$f" ] || { echo "GATE: vector file missing: $f"; exit 1; }
+      done
     # 🔴 **Clear old results before running, or the gate counts ghosts.** The
     # runner reuses its build directory, so XML from a previous pipeline
     # survives — and a suite that stopped running entirely would still be