diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ebdea3088..e2367f2b7 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -33,6 +33,12 @@ jobs:
       - name: ESLint
         run: pnpm lint
 
+      # Prettier formatting gate. The format pass excludes generator-owned
+      # artifacts via .prettierignore (notably docs/api/openapi.yaml, which
+      # the OpenAPI drift check below enforces byte-for-byte).
+      - name: Prettier format check
+        run: pnpm format:check
+
       - name: TypeScript strict check
         run: pnpm typecheck
 
diff --git a/.prettierignore b/.prettierignore
index 06202557b..68f690586 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -2,5 +2,17 @@ node_modules
 .next
 out
 build
+coverage
+
+# Prisma-generated client.
 src/generated
+
+# Lockfile — owned by pnpm.
 pnpm-lock.yaml
+
+# Generator-owned API contract. The openapi:check job enforces its exact
+# bytes against the Zod registry, so prettier must never rewrite it.
+docs/api/openapi.yaml
+
+# Build-generated service worker (the PWA build emits it).
+public/sw.js