diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 00a47494..862f7b1e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -195,7 +195,9 @@ jobs:
   required-checks:
     if: gitea.event_name == 'pull_request'
     runs-on: self-hosted
-    needs: [lint, unit-tests, canary, best-practices, documentation, gitea-offline]
+    # #148: type-check MUST gate the protected status — a red type-check job
+    # previously left the protected merge gate green (dependency-chain hole).
+    needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]
     steps:
       - name: Publish protected-branch gate
         run: echo "All required CI checks passed"