diff --git a/scripts/test-server-backport-consumer-contract.py b/scripts/test-server-backport-consumer-contract.py
index 226bc21c04..c2adf2af3b 100644
--- a/scripts/test-server-backport-consumer-contract.py
+++ b/scripts/test-server-backport-consumer-contract.py
@@ -36,6 +36,13 @@ def verify(files):
         require(marker in docker, 'Official download/custom runtime version boundary changed')
     require('PASTURESTACK_GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1' in build,
             'Runtime readback still expects the original libc version')
+    runtime_version = re.findall(r'^ARG GLIBC_RUNTIME_PACKAGE_VERSION=(\S+)$', docker, re.M)
+    libc_checks = re.findall(
+        r'for (?:package|glibc_package) in libc6 libc-bin libc-gconv-modules-extra; do\n(.*?)\n    done',
+        build, re.S)
+    require(len(runtime_version) == 1 and len(libc_checks) == 2 and all(
+        re.findall(r' =\s*(?:\\\s*)?"([^"\n]+)"', check) == runtime_version for check in libc_checks),
+        'Post-build libc package oracles must match the final runtime pin')
     runtime = docker.split('source=/out,target=/opt/pasturestack/ubuntu-security-backports,ro', 1)[1]
     positions = [runtime.index(marker) for marker in [
         'sh /tmp/pasturestack-security-input/install-ubuntu-security-updates.sh',
@@ -89,6 +96,14 @@ def test_official_runtime_version_conflation_is_rejected(self):
                 'ENV PASTURESTACK_GLIBC_PACKAGE_VERSION=${GLIBC_RUNTIME_PACKAGE_VERSION}',
                 'ENV PASTURESTACK_GLIBC_PACKAGE_VERSION=${GLIBC_PACKAGE_VERSION}')}))
 
+    def test_each_post_build_libc_oracle_mismatch_is_rejected(self):
+        for variable in ['package', 'glibc_package']:
+            pattern = rf'(for {variable} in libc6 libc-bin libc-gconv-modules-extra; do\n.*?\n    done)'
+            broken = re.sub(pattern, lambda match: match[0].replace(
+                '2.43-2ubuntu2.4+pasturestack.1', '2.43-2ubuntu2.4'), FILES[BUILD], count=1, flags=re.S)
+            with self.subTest(variable=variable), self.assertRaises(AssertionError):
+                verify(dict(FILES, **{BUILD: broken}))
+
     def test_unbound_vex_or_narrowed_raw_scan_is_rejected(self):
         for old, new in [('--bundle-checksums', '--candidate-checksums'),
                          ('--scanners vuln,secret --list-all-pkgs', '--scanners vuln,secret --list-all-pkgs --offline-scan')]:
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index 4903b96c48..ec56262659 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -513,7 +513,7 @@ docker run --rm --network none --entrypoint sh "$image" -eu -c '
 docker run --rm --entrypoint bash "$image" -lc '
     set -euo pipefail
     for package in libc6 libc-bin libc-gconv-modules-extra; do
-        test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${package}")" = "2.43-2ubuntu2.4"
+        test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${package}")" = "2.43-2ubuntu2.4+pasturestack.1"
     done
     for package in libperl5.40 perl perl-base perl-modules-5.40; do
         test "$(dpkg-query -W -f='"'"'${Version}'"'"' "${package}")" = "5.40.1-7ubuntu0.3"