diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d999a11..7de8c32 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,10 +26,18 @@ jobs:
           check-latest: true
           cache: true
 
+      # qpdf is a second, independent oracle: it reads back what we wrote and
+      # says whether it is well formed. Without it TestObjectStreamsQPDF skips
+      # and the lane is green over the one test a stranger performs.
+      - name: qpdf, the independent oracle for what we write
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq qpdf
+
       - name: go vet
         run: go vet ./...
 
       - name: Test with coverage
+        env:
+          PDFKIT_REQUIRE_QPDF: "1"
         run: go test -covermode=set -coverprofile=coverage.out ./...
 
       - name: Assert exact 100% statement coverage
diff --git a/objstm_test.go b/objstm_test.go
index 387da05..7276d73 100644
--- a/objstm_test.go
+++ b/objstm_test.go
@@ -343,6 +343,12 @@ func TestObjectStreamsRichDocument(t *testing.T) {
 func TestObjectStreamsQPDF(t *testing.T) {
 	qpdf, err := exec.LookPath("qpdf")
 	if err != nil {
+		// A skipped oracle reads exactly like a passing one. The lane that
+		// installs qpdf sets this, so its absence there is a broken lane and
+		// not a reason to go quietly green.
+		if os.Getenv("PDFKIT_REQUIRE_QPDF") != "" {
+			t.Fatalf("PDFKIT_REQUIRE_QPDF is set but qpdf is not installed: %v", err)
+		}
 		t.Skip("qpdf not installed")
 	}
 	dir := t.TempDir()