diff --git a/.gitea/workflows/gate.yml b/.gitea/workflows/gate.yml
index 442a575..5a3bf1d 100644
--- a/.gitea/workflows/gate.yml
+++ b/.gitea/workflows/gate.yml
@@ -50,8 +50,12 @@ jobs:
       # CI here (it is a separate repo; SPEC_REPO_SLUG is not wired into this runner), so
       # the guard honestly SKIPS (exit 3) rather than faking green. A real drift/edit of a
       # co-located spec would exit 1 and fail. Tolerated: exit 3 only.
+      # Call the script DIRECTLY, not via `make`: GNU make masks a recipe's exit code as
+      # its own 2 on failure, so `make spec-immutability || [ $? -eq 3 ]` would see 2 and
+      # fail. The script itself exits 3 on an honest skip (spec repo not checked out here),
+      # which we tolerate; a real drift/edit exits 1 and fails the gate.
       - name: Spec immutability (R-TEST-06, skips if spec repo absent)
-        run: make -C ci spec-immutability || [ "$?" -eq 3 ]
+        run: ./ci/spec-immutability.sh || [ "$?" -eq 3 ]
 
       - name: Static gate — lint + Kyverno L0 + L1 render
         run: make -C ci lint l0 l1