diff --git a/.github/workflows/validation.yaml b/.github/workflows/validation.yaml
index aa48fb336..e222a0f0a 100644
--- a/.github/workflows/validation.yaml
+++ b/.github/workflows/validation.yaml
@@ -31,6 +31,13 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # Lock content is OS-independent, so one leg is enough coverage.
+      - name: Check package-lock.json is up to date
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          npm install --package-lock-only
+          git diff --exit-code package-lock.json
+
       - name: Check for secrets leaks
         run: npx secretlint "**/*"
 
diff --git a/package-lock.json b/package-lock.json
index c38b48387..3c6c2da77 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5207,7 +5207,6 @@
       "version": "0.5.17",
       "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.17.tgz",
       "integrity": "sha512-+Ut8d9LLqwEvHHJl1+PIHqoyDxFgVN847JTVM3Izi3xHDWPE4UtzzXysMZQs64DMcrJfBeS/uoEP4AD3HQHnQQ==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=12.0"