diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cc3468a..7ccbc57 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -991,6 +991,7 @@ jobs:
           ./build/dw-${{ matrix.name }} --version
           ./build/dw-${{ matrix.name }} runtime:check
           ./build/dw-${{ matrix.name }} list
+          ./build/dw-${{ matrix.name }} upgrade --dry-run --output=json
 
       - name: Restore locked launcher qualification dependencies
         if: needs.resolve-release.outputs.cache_warm != 'true'
@@ -1503,6 +1504,7 @@ jobs:
           .\build\dw-windows-x86_64.exe --version
           .\build\dw-windows-x86_64.exe runtime:check
           .\build\dw-windows-x86_64.exe list
+          .\build\dw-windows-x86_64.exe upgrade --dry-run --output=json
 
       - name: Retain the verified standalone dependency inventory
         if: needs.resolve-release.outputs.cache_warm != 'true'
diff --git a/scripts/ci/test-standalone-dependencies.js b/scripts/ci/test-standalone-dependencies.js
index 1165c85..d1f5422 100644
--- a/scripts/ci/test-standalone-dependencies.js
+++ b/scripts/ci/test-standalone-dependencies.js
@@ -102,3 +102,13 @@ test('all four public dependency inventories use the ordinary required-asset and
   }
   assert.match(publication, /subject-path: dist\/\*/);
 });
+
+test('each native platform exercises read-only outbound HTTPS before its release artifact is handed off', () => {
+  const workflow = fs.readFileSync(path.join(__dirname, '../../.github/workflows/release.yml'), 'utf8');
+  const unix = workflow.split('\n  build-binary:')[1].split('\n  build-binary-windows:')[0];
+  const windows = workflow.split('\n  build-binary-windows:')[1].split('\n  bundle-release:')[0];
+  for (const job of [unix, windows]) {
+    assert.match(job, /upgrade --dry-run --output=json/);
+    assert.ok(job.indexOf('upgrade --dry-run --output=json') < job.indexOf('Retain the verified standalone dependency inventory'));
+  }
+});