diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0744f22..c61579f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -210,6 +210,13 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
           path: sdk-python
+      # The Server PHP parent contains affected APT. Keep this consumer closed
+      # until #295 selects an accepted fixed parent and first-RUN version guard.
+      - name: Refuse the unqualified Server image build
+        shell: bash
+        run: |
+          echo '::error title=Server producer blocked::Integration image builds require the fixed APT producer in durable-workflow/.github#295.'
+          exit 1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
diff --git a/.github/workflows/docs-pr.yml b/.github/workflows/docs-pr.yml
index 64d22a9..212ad73 100644
--- a/.github/workflows/docs-pr.yml
+++ b/.github/workflows/docs-pr.yml
@@ -38,6 +38,12 @@ jobs:
           clients: pip,python
       - name: Install package and documentation dependencies
         run: pip install -e '.[docs]'
+      # Central #298 must prove both APT and libapt before this networked install.
+      - name: Refuse unqualified browser dependency installation
+        shell: bash
+        run: |
+          echo '::error title=APT prerequisite blocked::Browser dependencies require the accepted APT/libapt preflight in durable-workflow/.github#298.'
+          exit 1
       - name: Install Chromium
         env:
           NODE_OPTIONS: --use-openssl-ca
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 4232aff..5978c9f 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -106,6 +106,12 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
       - name: Install package and documentation dependencies
         run: pip install -e '.[docs]'
+      # Central #298 must prove both APT and libapt before this networked install.
+      - name: Refuse unqualified browser dependency installation
+        shell: bash
+        run: |
+          echo '::error title=APT prerequisite blocked::Browser dependencies require the accepted APT/libapt preflight in durable-workflow/.github#298.'
+          exit 1
       - name: Install Chromium
         env:
           NODE_OPTIONS: --use-openssl-ca