diff --git a/config/scripts/check-bounded-ingress.test.mjs b/config/scripts/check-bounded-ingress.test.mjs
index 4668aab72d1..baef49bbc2d 100644
--- a/config/scripts/check-bounded-ingress.test.mjs
+++ b/config/scripts/check-bounded-ingress.test.mjs
@@ -77,6 +77,16 @@ describe('check-bounded-ingress', () => {
     ).toEqual([])
   })
 
+  it('keeps the CLI boot-check wired into the desktop and release builds', () => {
+    // Electron output once clobbered a CLI dependency emitted under out/main; the boot-check is the
+    // guard, and CI calls `pnpm verify:cli-runtime` directly, so a dropped script fails the job.
+    const root = path.resolve(import.meta.dirname, '../..')
+    const pkg = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'))
+    expect(pkg.scripts['verify:cli-runtime']).toBeDefined()
+    expect(pkg.scripts['build:desktop']).toContain('verify:cli-runtime')
+    expect(pkg.scripts['build:release']).toContain('verify:cli-runtime')
+  })
+
   it('stays wired into pnpm lint', () => {
     // A gate that can be unwired without any test failing WILL be unwired by a rebase — this one
     // already was once, and the ratchet cannot detect its own removal.
diff --git a/package.json b/package.json
index 44b3ecbf608..811f89e9e2a 100644
--- a/package.json
+++ b/package.json
@@ -65,9 +65,9 @@
     "build:cli": "tsc -p config/tsconfig.cli.json --outDir out --composite false --incremental false && node config/scripts/verify-cli-bin.mjs --fix-executable --fix-package-json && node config/scripts/install-dev-cli.mjs",
     "build:electron-vite": "node config/scripts/run-electron-vite-build.mjs",
     "build:web": "node config/scripts/run-vite-web-build.mjs && node config/scripts/verify-web-build.mjs",
-    "build:desktop": "pnpm run typecheck && pnpm run build:relay && pnpm run build:cli && pnpm run build:electron-vite && pnpm run build:web",
+    "build:desktop": "pnpm run typecheck && pnpm run build:relay && pnpm run build:cli && pnpm run build:electron-vite && pnpm run verify:cli-runtime && pnpm run build:web",
     "build": "pnpm run build:desktop && pnpm run build:native",
-    "build:release": "pnpm run build:relay && pnpm run build:native && pnpm run verify:computer-native && pnpm run build:cli && pnpm run build:electron-vite && pnpm run build:web",
+    "build:release": "pnpm run build:relay && pnpm run build:native && pnpm run verify:computer-native && pnpm run build:cli && pnpm run build:electron-vite && pnpm run verify:cli-runtime && pnpm run build:web",
     "postinstall": "node config/scripts/rebuild-native-deps.mjs",
     "rebuild:electron": "node config/scripts/rebuild-native-deps.mjs",
     "rebuild:node": "pnpm rebuild node-pty",
@@ -105,7 +105,8 @@
     "bench:cold-park-reveal": "pnpm run ensure:electron-runtime && node tools/benchmarks/terminal-cold-park-reveal-bench.mjs",
     "bench:cold-park-resource": "pnpm run ensure:electron-runtime && node tools/benchmarks/terminal-cold-park-resource-bench.mjs",
     "bench:compare": "node config/scripts/compare-benchmark-artifacts.mjs",
-    "check:bounded-ingress": "node config/scripts/check-bounded-ingress.mjs"
+    "check:bounded-ingress": "node config/scripts/check-bounded-ingress.mjs",
+    "verify:cli-runtime": "node config/scripts/verify-cli-bin.mjs --run-help"
   },
   "dependencies": {
     "@electron-toolkit/preload": "^3.0.2",