diff --git a/.gitattributes b/.gitattributes
index 713416057..e67042f0a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -37,3 +37,9 @@ bin/*        text eol=lf
 *.gif        binary
 *.ico        binary
 *.pdf        binary
+
+# The committed diagram-render bundle is hash-pinned (BUILD_INFO sha256);
+# a CRLF rewrite on Windows checkout would break the drift test and change
+# the content-addressed staged filename.
+lib/diagram-render/dist/*.html text eol=lf
+lib/diagram-render/dist/*.json text eol=lf
diff --git a/.github/workflows/make-pdf-gate.yml b/.github/workflows/make-pdf-gate.yml
index 769fccd2b..cd07e26bc 100644
--- a/.github/workflows/make-pdf-gate.yml
+++ b/.github/workflows/make-pdf-gate.yml
@@ -4,6 +4,8 @@ on:
     branches: [main]
     paths:
       - 'make-pdf/**'
+      - 'lib/diagram-render/**'
+      - 'test/diagram-render-drift.test.ts'
       - 'browse/src/meta-commands.ts'
       - 'browse/src/write-commands.ts'
       - 'browse/src/commands.ts'
@@ -81,7 +83,7 @@ jobs:
           which pdftotext && pdftotext -v 2>&1 | head -1 || true
 
       - name: Run make-pdf unit tests
-        run: bun test make-pdf/test/*.test.ts
+        run: bun test make-pdf/test/*.test.ts test/diagram-render-drift.test.ts
 
       - name: Run E2E gates (combined-features copy-paste + emoji render)
         env: