diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d98a226..96d6593 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,6 +43,11 @@ jobs:
           INTENTPROOF_SPEC_DIR: ${{ github.workspace }}/intentproof-spec
         run: go test -count=1 ./...
 
+      - name: Spec conformance (policy compiler vs pinned spec)
+        env:
+          INTENTPROOF_SPEC_DIR: ${{ github.workspace }}/intentproof-spec
+        run: bash scripts/check-spec-conformance.sh
+
       - name: Verify counterparty golden bundle stdout
         env:
           INTENTPROOF_SPEC_DIR: ${{ github.workspace }}/intentproof-spec
diff --git a/scripts/check-spec-conformance.sh b/scripts/check-spec-conformance.sh
new file mode 100755
index 0000000..f168a6a
--- /dev/null
+++ b/scripts/check-spec-conformance.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Run Go policy/compiler tests against the pinned intentproof-spec checkout.
+set -euo pipefail
+
+SPEC_DIR="${1:-${INTENTPROOF_SPEC_DIR:-../intentproof-spec}}"
+
+if [[ ! -f "$SPEC_DIR/schema/policy.v1.schema.json" ]]; then
+  echo "spec schema not found at: $SPEC_DIR/schema/policy.v1.schema.json" >&2
+  exit 2
+fi
+
+SPEC_DIR_ABS="$(cd "$SPEC_DIR" && pwd)"
+
+INTENTPROOF_SPEC_DIR="$SPEC_DIR_ABS" \
+INTENTPROOF_DETERMINISTIC_TIME=1 \
+  go test ./pkg/policy -run 'TestPolicyCompilerMatchesSpecSchema|TestReferencePolicyFixturesMatchVerifier' -count=1