diff --git a/.github/workflows/trusted-uv-materializer-quality-ci.yml b/.github/workflows/trusted-uv-materializer-quality-ci.yml
index db70ec324c..4b8e58092c 100644
--- a/.github/workflows/trusted-uv-materializer-quality-ci.yml
+++ b/.github/workflows/trusted-uv-materializer-quality-ci.yml
@@ -12,6 +12,7 @@ on:
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci-hashes.txt"
       - "pyproject.toml"
   push:
     branches: [main]
@@ -24,6 +25,7 @@ on:
       - "tests/test_uv*.py"
       - "tests/test_repository_branch_coverage_*.py"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci-hashes.txt"
       - "pyproject.toml"
 
 concurrency:
@@ -104,10 +106,12 @@ jobs:
         with:
           python-version: "3.14"
           cache: pip
-          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+          cache-dependency-path: |
+            requirements-opencode-review-ci-hashes.txt
+            requirements-noema-document-ci-hashes.txt
 
       - name: Install hash-locked quality tooling
-        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt -r requirements-noema-document-ci-hashes.txt
 
       - name: Run trusted uv tests with complete branch coverage
         run: |
diff --git a/tests/test_trusted_uv_materializer_quality_workflow_contract.py b/tests/test_trusted_uv_materializer_quality_workflow_contract.py
index 50a5ddb5fe..92e69149e9 100644
--- a/tests/test_trusted_uv_materializer_quality_workflow_contract.py
+++ b/tests/test_trusted_uv_materializer_quality_workflow_contract.py
@@ -26,6 +26,7 @@ def test_quality_workflow_runs_for_every_materializer_surface() -> None:
         '"tests/test_uv*.py"',
         '"tests/test_repository_branch_coverage_*.py"',
         '"requirements-opencode-review-ci-hashes.txt"',
+        '"requirements-noema-document-ci-hashes.txt"',
         '"pyproject.toml"',
     )
     for required_path in required_paths:
@@ -70,8 +71,12 @@ def test_full_quality_gate_proves_tests_coverage_docstrings_and_compilation() ->
     assert 'python-version: "3.14"' in workflow
     assert (
         "python -m pip install --disable-pip-version-check --require-hashes "
-        "-r requirements-opencode-review-ci-hashes.txt"
+        "-r requirements-opencode-review-ci-hashes.txt "
+        "-r requirements-noema-document-ci-hashes.txt"
     ) in workflow
+    assert "defusedxml==0.7.1" in Path(
+        "requirements-noema-document-ci-hashes.txt"
+    ).read_text(encoding="utf-8")
     assert "branch = True" in workflow
     assert "scripts/ci/materialize_base_python_requirements.py" in workflow
     assert "fail_under = 100" in workflow