diff --git a/tests/conformance/CMakeLists.txt b/tests/conformance/CMakeLists.txt
new file mode 100644
index 0000000..b04c02b
--- /dev/null
+++ b/tests/conformance/CMakeLists.txt
@@ -0,0 +1,26 @@
+# Wires the conformance suite into ctest, so `ctest -L conformance` — the check
+# .github/workflows/ci.yml's `conformance` job runs, and the one BRANCH_PROTECTION.md
+# names as required "when tests/conformance/ lands" — actually runs it. Without this file
+# that job's presence-check finds neither a CMakeLists.txt nor a package.json here and
+# silently no-ops to a green "skipped", forever: the M0 exit gate would never actually
+# gate anything. Owned by lane PROTO.
+#
+# One ctest entry shells out to run.sh — the exact command tests/conformance/README.md
+# tells a human to run locally. That is deliberate: there is exactly one definition of
+# "the suite passed", not a CMake-flavoured near-duplicate of it that can drift from the
+# real one. The native (C++) half also gets its own finer-grained test via add_subdirectory
+# below, for a lane iterating on core/generated/ who doesn't want npm's cost every run.
+
+add_subdirectory(cpp)
+
+add_test(
+    NAME conformance
+    COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/run.sh
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+)
+set_tests_properties(conformance PROPERTIES
+    LABELS "conformance"
+    # Installs two npm trees and runs a ten-minute-capable suite end to end; generous but
+    # not unbounded, so a genuinely hung mockd fails the job instead of the runner.
+    TIMEOUT 600
+)
diff --git a/tests/conformance/cpp/CMakeLists.txt b/tests/conformance/cpp/CMakeLists.txt
index 81b9413..f892f66 100644
--- a/tests/conformance/cpp/CMakeLists.txt
+++ b/tests/conformance/cpp/CMakeLists.txt
@@ -4,6 +4,14 @@
 # this exercises the wire types, which is a separate concern from the engine. See
 # docs/adr/0009-generated-protocol-library.md.
 
+# The root CMakeLists.txt only find_package(nlohmann_json)'s when daemon/CMakeLists.txt
+# exists (daemon is its real consumer), so this target may not exist yet when this
+# directory configures on its own — this suite must not depend on daemon having landed.
+# Self-sufficient rather than reaching into the root file to widen that guard.
+if(NOT TARGET nlohmann_json::nlohmann_json)
+    find_package(nlohmann_json 3.11 REQUIRED)
+endif()
+
 add_executable(velox_conformance_cpp
     conformance_main.cpp
     ${CMAKE_SOURCE_DIR}/core/generated/velox_proto.cpp)
@@ -18,3 +26,4 @@ target_link_libraries(velox_conformance_cpp PRIVATE nlohmann_json::nlohmann_json
 # The runner needs the repository root so it can find contracts/fixtures.
 add_test(NAME conformance_cpp
          COMMAND velox_conformance_cpp ${CMAKE_SOURCE_DIR})
+set_tests_properties(conformance_cpp PROPERTIES LABELS "conformance")
diff --git a/tests/conformance/run.sh b/tests/conformance/run.sh
index fbc89d5..24756de 100755
--- a/tests/conformance/run.sh
+++ b/tests/conformance/run.sh
@@ -54,6 +54,12 @@ step() { printf '\n=== %s ===\n' "$1"; }
 
 # ---------------------------------------------------------------- 1. static
 step "static conformance (schemas, fixtures, generated code)"
+# jsonschema/referencing aren't part of tools/bootstrap.sh's apt list (that's PKG's
+# script; these are this suite's own Python deps), so this suite installs them itself
+# rather than assuming a CI image happens to have them. Cheap and idempotent when
+# they're already present, which is every local dev run after the first.
+python3 -c "import jsonschema, referencing" 2>/dev/null \
+  || python3 -m pip install --quiet --disable-pip-version-check --user jsonschema referencing
 python3 "$HERE/check_contract.py"
 
 # ------------------------------------------------------------------- 2. C++