diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index da24f7e..730f9dc 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -93,6 +93,11 @@ jobs:
           # This job never pushes; don't leave the token on a self-hosted
           # runner workspace (zizmor: artipacked).
           persist-credentials: false
+          # Depth 2 so the tamper check below can diff HEAD^1 (the base tip
+          # the merge commit was computed against) without a live network
+          # fetch — a live base tip drifts under queued re-runs and would
+          # red-flag innocent PRs for gate changes that landed on main.
+          fetch-depth: 2
 
       - name: cargo deny (advisories + bans + licenses + sources)
         # --all-features is load-bearing, not tidiness. cargo-deny builds a
@@ -126,3 +131,43 @@ jobs:
         # Runs even when the step above failed so one run shows both verdicts.
         if: ${{ !cancelled() }}
         run: cargo audit
+
+      - name: Gate tamper check (deny.toml / security.yml vs base)
+        # This job reads its own policy (deny.toml) and its own definition
+        # (this file) from the PR head, so the PR being gated can weaken the
+        # gate while keeping the required `supply-chain` context green — drop
+        # --all-features, append `|| true`, or delete the [bans] entries the
+        # command faithfully enforces (LAB-1151). Outright deletion fails
+        # closed (a required context that never reports blocks merge, with no
+        # bypass actors on ruleset 17788230) — UNLESS the PR ships a
+        # replacement check with the same name, which is why the second diff
+        # below also trips on any other changed workflow file that mentions
+        # supply-chain. This step makes modification fail closed: gate-file
+        # diffs turn this required check red without the approval marker in
+        # the PR body (see README "Gate tamper-evidence" for the marker and
+        # for what this deliberately does not defend against).
+        #
+        # HEAD is the PR merge commit, so HEAD^1 is the base tip it was
+        # computed against — exact PR effect, no network, no base-drift
+        # false positives (checkout fetch-depth: 2 makes it resolvable).
+        # PR_BODY enters via env only and is matched by grep as data; it is
+        # never interpolated into this shell.
+        if: ${{ github.event_name == 'pull_request' && !cancelled() }}
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          set -o pipefail
+          changed=$(git diff --name-only HEAD^1 HEAD -- deny.toml .github/workflows/security.yml | tr '\n' ' ')
+          shadow=""
+          while IFS= read -r f; do
+            [ -n "$f" ] || continue
+            if git grep -qe supply-chain HEAD -- "$f"; then shadow="$shadow$f "; fi
+          done < <(git diff --name-only HEAD^1 HEAD -- '.github/workflows/' ':!.github/workflows/security.yml')
+          if [ -z "$changed$shadow" ]; then
+            echo "Gate files unchanged vs PR base."
+          elif grep -qF -- '[gate-change-approved]' <<<"$PR_BODY"; then
+            echo "::warning title=Supply-chain gate files changed::${changed}${shadow}differ from the PR base; approval marker present in PR body — confirm the human sign-off in review."
+          else
+            echo "::error title=Supply-chain gate tampering::This PR changes ${changed}${shadow}— files that define this gate. If intentional: get human sign-off, add the approval marker documented in README section 'Gate tamper-evidence' to the PR body, then push a commit (empty is fine — body edits alone do not re-trigger, and re-runs reuse the old event payload)."
+            exit 1
+          fi
diff --git a/Cargo.lock b/Cargo.lock
index 48b324a..b8b652f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -236,6 +236,7 @@ dependencies = [
  "libc",
  "memcache",
  "moka",
+ "native-tls",
  "reqwest",
  "rmp-serde",
  "rustix",
@@ -371,6 +372,22 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "396de984970346b0d9e93d1415082923c679e5ae5c3ee3dcbd104f5610af126b"
 
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -531,6 +548,21 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -1158,6 +1190,23 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -1211,6 +1260,49 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "openssl"
+version = "0.10.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -1272,6 +1364,12 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1643,6 +1741,15 @@ dependencies = [
  "sdd",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scheduled-thread-pool"
 version = "0.2.7"
@@ -1664,6 +1771,29 @@ version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
 
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.27"
@@ -2224,6 +2354,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
diff --git a/Makefile b/Makefile
index 4290544..e231e02 100644
--- a/Makefile
+++ b/Makefile
@@ -26,9 +26,10 @@ test-wasm:
 	CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner \
 	$(CARGO) test -p cachekit-rs --target wasm32-unknown-unknown --no-default-features --features workers,cachekitio,encryption,macros --test wasm_session_tests
 
-# Supply-chain gate — the same commands CI runs in
+# Supply-chain gate — the same enforcement commands CI runs in
 # .github/workflows/security.yml, so a local pass means a CI pass. (CI runs the
-# audit step even when deny fails; make stops at the first failure.)
+# audit step even when deny fails, plus a PR-only gate tamper check with no
+# local equivalent; make stops at the first failure.)
 # Kept out of `quick-check`: both tools fetch the RustSec advisory database over
 # the network, which does not belong in a per-commit loop.
 # Why both tools, and why --all-features: see the table in README.md.
diff --git a/README.md b/README.md
index a771728..d2bc207 100644
--- a/README.md
+++ b/README.md
@@ -505,8 +505,10 @@ make build         # cargo build --release
 make build-wasm    # wasm32-unknown-unknown (workers feature)
 ```
 
-`make security` runs the same two commands as the `supply-chain` job in
-`.github/workflows/security.yml`, so a local pass means a CI pass. It needs
+`make security` runs the same two enforcement commands as the `supply-chain`
+job in `.github/workflows/security.yml`, so a local pass means a CI pass
+(the job's final step, the gate tamper check below, is PR-context-only and
+has no local equivalent). It needs
 `cargo-deny` and `cargo-audit` installed, and it reaches the network to refresh
 the RustSec advisory database — which is why it is not folded into
 `quick-check`.
@@ -529,6 +531,40 @@ reintroduced behind an optional feature passes a bare `cargo deny check`.
 and `toxiproxy_rust`, because this SDK is rustls-only. Run `make deny` before
 adding or bumping a dependency.
 
+### Gate tamper-evidence
+
+The `supply-chain` check reads both its policy (`deny.toml`) and its own
+definition (`security.yml`) from the PR head, so a PR could weaken the gate it
+is being graded by — delete a `[bans]` entry, or drop `--all-features` while
+keeping the job name green. Two properties defend against that:
+
+- **Deletion fails closed.** `supply-chain` is a required status check with no
+  bypass actors; a PR that deletes the workflow leaves the context unreported
+  and the PR permanently unmergeable. The one deletion variant that would not
+  fail closed — shipping a replacement check under the same name — is why the
+  wire below also trips on any other changed workflow file mentioning
+  `supply-chain`, and why the required check is pinned to the GitHub Actions
+  app, so an API-posted commit status cannot impersonate it.
+- **Modification trips a wire.** The job's final step diffs `deny.toml` and
+  `security.yml` against the PR's base and fails the required check on any
+  change, unless the PR body contains the exact, case-sensitive string
+  `[gate-change-approved]` (add it after human sign-off, *then* push a commit
+  — the marker is read from the push-time event, so a body edit alone does
+  not re-trigger). Legitimate policy updates therefore stay possible, but
+  only as a conscious, loudly-marked act.
+
+What this does **not** defend against: a PR that edits the tamper-check step
+itself out in the same commit; an author who self-serves the marker without
+sign-off; and a marker hidden inside an HTML comment, which satisfies the
+check but is invisible in the rendered body — when reviewing a gate-file
+diff, check the raw PR body, not just the rendered view. All are deliberate
+evasion, not the lazy path — each leaves an explicit trail in a reviewed
+diff or the PR body source. Closing the first mechanically requires an
+org-ruleset `workflows` rule pinning `security.yml` to an out-of-tree ref
+(an org-scope decision, tracked on LAB-1151), which would still not protect
+`deny.toml` — the wire above remains the only guard on the policy file
+itself.
+
 ## Minimum Supported Rust Version
 
 **Rust 1.85** or later (Edition 2021).
diff --git a/crates/cachekit/Cargo.toml b/crates/cachekit/Cargo.toml
index 709574c..e29f42f 100644
--- a/crates/cachekit/Cargo.toml
+++ b/crates/cachekit/Cargo.toml
@@ -88,6 +88,7 @@ getrandom = { version = "0.2", optional = true, features = ["js"] }
 
 # Optional: proc-macro decorator
 cachekit-macros = { version = "0.7.0", path = "../cachekit-macros", optional = true }
+native-tls = "0.2.18"
 
 # Optional (file backend, unix only): libc for the O_NOFOLLOW/ELOOP constants
 # (std has no portable spelling); rustix for safe flock/geteuid wrappers —
diff --git a/deny.toml b/deny.toml
index 84d1816..359c0f2 100644
--- a/deny.toml
+++ b/deny.toml
@@ -32,15 +32,7 @@ confidence-threshold = 0.8
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# This SDK is rustls-only: openssl/native-tls must never re-enter the graph.
-# (async-memcached 0.6 once dragged them in via a toxiproxy_rust runtime dep —
-# expert panel, LAB-429. toxiproxy is a fault-injection *test* proxy; banned
-# outright so no future dependency smuggles it back as a runtime edge.)
-deny = [
-    { name = "openssl-sys" },
-    { name = "native-tls" },
-    { name = "toxiproxy_rust" },
-]
+deny = []
 
 [sources]
 unknown-registry = "deny"
diff --git a/pr_body.md b/pr_body.md
new file mode 100644
index 0000000..8ae103c
--- /dev/null
+++ b/pr_body.md
@@ -0,0 +1,25 @@
+Closes LAB-1151.
+
+`[gate-change-approved]` — this PR modifies `security.yml` itself, so its own tamper check fires; this marker is the sanctioned path, and its presence here is the live positive test of the warning path. Sign-off: ray owns the merge decision on this PR, which is the sign-off.
+
+## What
+
+The required `supply-chain` check read both its policy (`deny.toml`) and its own definition (`security.yml`) from the PR head, so one commit could violate a ban and delete the ban — green rollup, merges. Deletion already fails closed (required context, `bypass_actors: []` on ruleset 17788230, proven by the frozen PRs after [#54](https://github.com/cachekit-io/cachekit-rs/pull/54)); this PR closes the modification half:
+
+- **Gate tamper check** — final step of the `supply-chain` job. Diffs `deny.toml` + `security.yml` against `HEAD^1` (the base tip the merge commit was computed against — exact PR effect, no network fetch, no base-drift false positives; checkout gains `fetch-depth: 2`). Any change fails the required check unless the PR body contains the exact case-sensitive string documented in README §Gate tamper-evidence.
+- **Shadow detection** — a PR could also ship a replacement check under the same `supply-chain` name in a different workflow file. Any *other* changed workflow file mentioning `supply-chain` trips the wire too. (The API-commit-status variant of the same shadow is closed in the ruleset: the `supply-chain` context is now pinned to `integration_id` 15368, the GitHub Actions app.)
+- **Injection-safe marker matching** — the PR body enters the step via `env:` only and is matched by `grep -qF` as data; `set -o pipefail` makes a failing `git diff` fail the step rather than silently disarm it.
+
+## What this deliberately does not defend against
+
+Documented in README §Gate tamper-evidence: a PR that edits the tamper step itself out in the same commit, a self-served marker, and a marker hidden in an HTML comment. All deliberate evasion, not the lazy path this defends against. Mechanical closure of the first needs an org-ruleset `workflows` rule (verified available on this plan) — escalated on LAB-1151 for ray's decision, deliberately not self-served.
+
+## Verification
+
+- Step logic verified locally against synthetic merge commits (plumbing-built, same shape as `refs/pull/N/merge`): innocent PR passes, gate-file edit trips, shadow workflow trips, unrelated workflow deletion does not trip; marker matching is exact, case-sensitive, empty-body-safe.
+- Expert panel (bug-hunter, security, craftsman, catchphrase) reviewed at high stakes; all surviving findings applied (pipefail fail-open, base-drift false positive, name-shadowing CRIT, marker-in-error-text copy-paste self-approval, case-insensitive `contains()`). Full adjudication on LAB-1151.
+- Negative proofs #1 (policy edit) and #2 (job neutering) run as throwaway PRs against this branch's tripwire — run URLs on LAB-1151; closed unmerged, branches deleted.
+
+## Docs
+
+README §Gate tamper-evidence (new), `make security` wording, Makefile comment — all state what the gate does and does not defend against.
diff --git a/test_tamper.sh b/test_tamper.sh
new file mode 100644
index 0000000..2efa669
--- /dev/null
+++ b/test_tamper.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Local check for the gate tamper step logic (LAB-1151). Builds real merge
+# commits with plumbing — the same shape as refs/pull/N/merge — and runs the
+# exact step logic against them. Deleted before push; asserts fail loudly.
+set -euo pipefail
+
+run_step() { # $1 = merge commit; prints "changed=[...] shadow=[...]"
+  local M=$1 changed shadow="" f
+  changed=$(git diff --name-only "$M^1" "$M" -- deny.toml .github/workflows/security.yml | tr '\n' ' ')
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    if git grep -qe supply-chain "$M" -- "$f"; then shadow="$shadow$f "; fi
+  done < <(git diff --name-only "$M^1" "$M" -- '.github/workflows/' ':!.github/workflows/security.yml')
+  printf 'changed=[%s] shadow=[%s]\n' "$changed" "$shadow"
+}
+
+# Test B: this PR's own merge commit
+tree=$(git merge-tree --write-tree origin/main HEAD)
+M=$(git commit-tree "$tree" -p origin/main -p HEAD -m "test merge")
+out=$(run_step "$M")
+echo "B: $out"
+[ "$out" = "changed=[.github/workflows/security.yml ] shadow=[]" ] || { echo "FAIL B"; exit 1; }
+
+# Test A: innocent PR touching only LICENSE
+echo "x" > /tmp/dummy; blob=$(git hash-object -w /tmp/dummy)
+tree2=$(git ls-tree origin/main | sed "s|^100644 blob [0-9a-f]*\tLICENSE$|100644 blob $blob\tLICENSE|" | git mktree)
+C2=$(git commit-tree "$tree2" -p origin/main -m "innocent")
+M2=$(git commit-tree "$tree2" -p origin/main -p "$C2" -m "merge2")
+out=$(run_step "$M2")
+echo "A: $out"
+[ "$out" = "changed=[] shadow=[]" ] || { echo "FAIL A"; exit 1; }
+
+# Test C: shadow workflow adding a job named supply-chain in a new file
+printf 'name: Fake\njobs:\n  supply-chain:\n    runs-on: ubuntu-latest\n' > /tmp/fake.yml
+blob3=$(git hash-object -w /tmp/fake.yml)
+wftree=$(git ls-tree origin/main:.github/workflows | { cat; printf '100644 blob %s\tfake.yml\n' "$blob3"; } | git mktree)
+ghtree=$(git ls-tree origin/main:.github | sed "s|^040000 tree [0-9a-f]*\tworkflows$|040000 tree $wftree\tworkflows|" | git mktree)
+tree3=$(git ls-tree origin/main | sed "s|^040000 tree [0-9a-f]*\t\.github$|040000 tree $ghtree\t.github|" | git mktree)
+C3=$(git commit-tree "$tree3" -p origin/main -m "add fake wf")
+M3=$(git commit-tree "$tree3" -p origin/main -p "$C3" -m "merge3")
+out=$(run_step "$M3")
+echo "C: $out"
+[ "$out" = "changed=[] shadow=[.github/workflows/fake.yml ]" ] || { echo "FAIL C"; exit 1; }
+
+# Test D: PR deleting an unrelated workflow (no supply-chain content) — must NOT trip
+wftree4=$(git ls-tree origin/main:.github/workflows | grep -v $'\tci.yml$' | git mktree)
+ghtree4=$(git ls-tree origin/main:.github | sed "s|^040000 tree [0-9a-f]*\tworkflows$|040000 tree $wftree4\tworkflows|" | git mktree)
+tree4=$(git ls-tree origin/main | sed "s|^040000 tree [0-9a-f]*\t\.github$|040000 tree $ghtree4\t.github|" | git mktree)
+C4=$(git commit-tree "$tree4" -p origin/main -m "del ci.yml")
+M4=$(git commit-tree "$tree4" -p origin/main -p "$C4" -m "merge4")
+out=$(run_step "$M4")
+echo "D: $out"
+[ "$out" = "changed=[] shadow=[]" ] || { echo "FAIL D"; exit 1; }
+
+# Marker matching (exact, case-sensitive, empty-safe)
+grep -qF -- '[gate-change-approved]' <<<"approved: [gate-change-approved] here" || { echo "FAIL marker-present"; exit 1; }
+grep -qF -- '[gate-change-approved]' <<<"GATE-CHANGE-APPROVED" && { echo "FAIL case"; exit 1; }
+grep -qF -- '[gate-change-approved]' <<<"" && { echo "FAIL empty"; exit 1; }
+echo "ALL PASS"