diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 07f9a1cf1..4ba396512 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -41,6 +41,24 @@ jobs:
       - name: Unit tests
         run: pnpm test
 
+      # v1.4.23 W4 F5c — OpenAPI spec drift check.
+      #
+      # `continue-on-error: true` is intentional for v1.4.23: the
+      # registry covers only the iOS-touched routes today, and the
+      # legacy hand-maintained spec at docs/api/openapi-v1422-legacy.yaml
+      # carries the rest. Once the registry hits ~95% coverage in
+      # v1.4.24+, flip this to a hard gate by removing
+      # `continue-on-error`.
+      - name: OpenAPI spec drift check
+        continue-on-error: true
+        run: |
+          pnpm openapi:generate
+          if ! git diff --exit-code docs/api/openapi.yaml; then
+            echo "::warning::OpenAPI spec out of date. Run 'pnpm openapi:generate' locally and commit the changes."
+            exit 1
+          fi
+          echo "::notice::OpenAPI spec in sync with Zod source schemas."
+
   dependency-audit:
     name: Dependency Audit
     runs-on: ubuntu-latest