diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index c300367..d8eaee5 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -66,9 +66,12 @@ jobs:
           otp-version: ${{ matrix.otp }}
           elixir-version: ${{ matrix.elixir }}
           version-type: ${{ matrix.version-type }}
+      # The OpenSSL `:crypto` linked is part of the pair: builds.hex.pm's OTP links the runner
+      # image's own, so the image decides it (3.0.13 on 24.04, 3.5.5 on 26.04), and the log says it.
       - name: the pair setup-beam installed (observed, quoted in the slice record)
         run: |
           erl -noshell -eval 'io:format("OTP ~s~n", [erlang:system_info(otp_release)]), halt().'
+          erl -noshell -eval 'ok = application:load(crypto), [{_, _, V}] = crypto:info_lib(), io:format("crypto linked to ~s~n", [V]), halt().'
           elixir --version
           cat .tool-versions
       - run: mix deps.get
diff --git a/test/beam_mcp/governance_test.exs b/test/beam_mcp/governance_test.exs
index 96c34a1..ce0f2ee 100644
--- a/test/beam_mcp/governance_test.exs
+++ b/test/beam_mcp/governance_test.exs
@@ -91,6 +91,18 @@ defmodule BeamMCP.GovernanceTest do
     end
   end
 
+  # A named image fixes the OpenSSL a leg's `:crypto` links only if the log says which one it
+  # was: the box leg's "OpenSSL 3.5" is a reading of its own run, not an inference from another
+  # repository's run on the same image.
+  test "the gate's toolchain step prints the OpenSSL :crypto linked, on every leg" do
+    text = File.read!(".github/workflows/gate.yml")
+    [_, step] = String.split(text, "- name: the pair setup-beam installed", parts: 2)
+    [step | _] = String.split(step, ~r/^\s+- /m, parts: 2)
+
+    assert step =~ "crypto:info_lib()",
+           "gate.yml's toolchain step does not print crypto:info_lib()"
+  end
+
   test "every workflow declares top-level permissions, and write permissions live on the job that needs them" do
     for wf <- @workflows do
       text = File.read!(wf)