diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4cd4d23e4..82ac518ff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,34 @@ jobs:
           cache: "pnpm"
       - run: pnpm install --frozen-lockfile
       - run: pnpm generate-sdk
+      - run: pnpm --filter @epilot/cli generate
+
+      # The repo commits the generated artifacts of both @epilot/sdk and
+      # @epilot/cli. Regenerating above and finding no diff is what keeps them
+      # honest — without this the generators run, the output is thrown away,
+      # and the committed copies drift unnoticed.
+      - name: Check generated artifacts are up to date
+        run: |
+          if ! git diff --quiet; then
+            echo "::error::Generated artifacts are out of date. Run 'pnpm generate-sdk && pnpm --filter @epilot/cli generate' and commit the result."
+            git diff --stat
+            exit 1
+          fi
+
       - run: pnpm build
+
+      # A build must not mutate tracked source: no code generation, no network
+      # fetches of live specs. Updating a spec is the deliberate
+      # 'npm run openapi' step documented in CONTRIBUTING.md. Checked directly
+      # after the build so a dirty tree can only be the build's doing.
+      - name: Check build left the tree clean
+        run: |
+          if ! git diff --quiet; then
+            echo "::error::'pnpm build' modified tracked files. A build must not regenerate or re-fetch committed source."
+            git diff --stat
+            exit 1
+          fi
+
       - run: pnpm test
 
   auto-release:
@@ -147,7 +174,15 @@ jobs:
               pkg.version = '${CLI_VERSION}';
               fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');
             "
-            FILES_TO_ADD="$FILES_TO_ADD packages/cli/package.json packages/cli-wrapper/package.json"
+            # src/index.ts embeds CLI_VERSION and definitions/ are copied from
+            # clients/, so the generated artifacts have to be rebuilt after the
+            # bump and staged with it. The "Build and test CLI" step above ran
+            # before the bump, and "Rebuild CLI with bumped version" runs after
+            # the push, so neither produces output this commit can carry.
+            cd "$GITHUB_WORKSPACE"
+            pnpm --filter @epilot/cli generate
+
+            FILES_TO_ADD="$FILES_TO_ADD packages/cli/ packages/cli-wrapper/package.json"
             TAGS="$TAGS @epilot/cli@${CLI_VERSION}"
           fi
 
diff --git a/clients/configuration-hub-client/package.json b/clients/configuration-hub-client/package.json
index 25f63351d..9b3898a10 100644
--- a/clients/configuration-hub-client/package.json
+++ b/clients/configuration-hub-client/package.json
@@ -10,8 +10,8 @@
     "bundle-definition": "webpack",
     "openapi": "node ../../scripts/update-openapi.js https://docs.api.epilot.io/configuration-hub.yaml",
     "typegen": "openapi typegen src/openapi.json --client > src/openapi.d.ts",
-    "build": "npm run typegen && npm run typescript && npm run bundle-definition",
-    "prepublishOnly": "npm run build"
+    "build": "npm run typescript && npm run bundle-definition",
+    "prepublishOnly": "npm run typegen && npm run build"
   },
   "files": [
     "*.js",
diff --git a/clients/journey-client/package.json b/clients/journey-client/package.json
index 7bd4a3085..16c20139e 100644
--- a/clients/journey-client/package.json
+++ b/clients/journey-client/package.json
@@ -10,9 +10,9 @@
     "bundle-definition": "webpack",
     "openapi": "node ../../scripts/update-openapi.js https://docs.api.epilot.io/journey-config.yaml",
     "typegen": "openapi typegen src/openapi.json --client > src/openapi.d.ts",
-    "build": "npm run openapi && npm run typegen && npm run typescript && npm run bundle-definition",
+    "build": "npm run typescript && npm run bundle-definition",
     "eslint": "../node_modules/.bin/eslint -c ../.eslintrc.yml",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run typegen && npm run build"
   },
   "files": [
     "*.js",