diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index c02f3f1c..d0ce1c1f 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -109,6 +109,16 @@ steps:
       # `apk add` guarantees openssl is present on PR pipelines too (and is a
       # fast no-op once the rebuilt image already ships it).
       - apk add --no-cache openssl
+      # Pi runtime (Invariant R): invariant_r_unittest.py hard-requires an
+      # installed `pi` binary at exactly this measured version — the test
+      # boots Pi's real tool registry to prove the read-only carve-out
+      # resolves to real, unshadowed builtins, and fails loud (by design)
+      # when the runtime is absent or drifts. The canonical Pi is
+      # @earendil-works/pi-coding-agent@0.84.1 exactly (@mariozechner/* is
+      # embedded-legacy). Step-level install because ci-base image publishes
+      # are currently blocked on registry auth; fold into Dockerfile.ci once
+      # that is fixed, keeping this as a fast no-op guard.
+      - npm install -g @earendil-works/pi-coding-agent@0.84.1
       # postgresql-client (pg_isready) is baked into ci-base.
       # Wait up to 60s for CI postgres to be ready; fail fast if it never comes up.
       - |