diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7616b46..33d69aa 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -53,7 +53,7 @@ jobs:
       - name: install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
+          pip install -r requirements-dev.txt -r requirements-contract.txt
 
       - name: ruff check
         run: ruff check backend
@@ -101,7 +101,7 @@ jobs:
       - name: install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
+          pip install -r requirements-dev.txt -r requirements-contract.txt
 
       - name: "pytest + coverage gate (fail below 70%)"
         run: |
@@ -153,7 +153,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install "bandit[toml]>=1.7" "pip-audit>=2.7"
-          pip install -r requirements.txt
+          pip install -r requirements.txt -r requirements-contract.txt
 
       - name: "bandit -lll (HIGH severity gate)"
         run: |
@@ -164,11 +164,11 @@ jobs:
 
       - name: "pip-audit (known vulnerabilities gate)"
         run: |
-          pip-audit -r requirements.txt --progress-spinner off
+          pip-audit -r requirements.txt -r requirements-contract.txt --progress-spinner off
 
       - name: pip-audit json report
         if: always()
-        run: pip-audit -r requirements.txt --progress-spinner off --format json -o pip-audit-report.json || true
+        run: pip-audit -r requirements.txt -r requirements-contract.txt --progress-spinner off --format json -o pip-audit-report.json || true
 
       - name: upload security artifacts
         if: always()
@@ -200,6 +200,14 @@ jobs:
           curl -fsSL -o /tmp/src.tar.gz "http://192.168.1.111:3000/${IMAGE_NAME}/archive/${GITHUB_SHA}.tar.gz"
           tar -xzf /tmp/src.tar.gz --strip-components=1 -C .
 
+      - name: "guard: deploy/Dockerfile"
+        run: |
+          if [ ! -f deploy/Dockerfile ]; then
+            echo "::error::deploy/Dockerfile отсутствует: сборка образа ждёт merge #18 (PR #49)."
+            echo "Пайплайн целиком проверен на ветке feat/17-verify (она же + deploy/Dockerfile)."
+            exit 1
+          fi
+
       - name: image meta
         id: meta
         run: |