diff --git a/.github/justfile b/.github/justfile
index d5d15dd..8f65873 100644
--- a/.github/justfile
+++ b/.github/justfile
@@ -43,6 +43,7 @@ smoke:
 # composed with each delivery, the aggregated matrix diffed against the
 # committed one.
 conformance-checks:
+    @just gha::_step conformance-ct::runner-js-pin-check
     @just gha::_step conformance-ct::all
     @just gha::_step conformance-ct::matrix-check
 
diff --git a/Cargo.toml b/Cargo.toml
index 4eabb8c..c7a687e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -47,14 +47,17 @@ wit-bindgen = { version = "0.60", features = ["async-spawn"] }
 wasip3 = "0.7"
 futures = { version = "0.3", default-features = false, features = ["std", "async-await"] }
 
-# The conformance stack, pinned to one revision everywhere it appears:
-# this rev, the `component-test`/`ct-runner` installs derived from
-# Cargo.lock by `conformance/driver-ct/justfile`, the deltic browser
-# driver's package.json pin, and the `polymorph-test/actions/*@<rev>`
-# refs in ci.yml (the actions fail on skew). To bump: `component-test
-# pins bump <rev> --cargo-toml Cargo.toml --package-json
-# conformance/driver-ct/deltic/package.json --workflow
-# .github/workflows/ci.yml`, then the follow-ups it prints.
+# The conformance stack: the Rust crates pinned by git rev, the JS
+# runner core from JSR (@jsr/polymorph__test, JSR's npm-compat registry
+# via conformance/driver-ct/deltic/.npmrc). Both sides of a bump name
+# ONE polymorph-test release: `component-test pins bump <rev>
+# --cargo-toml Cargo.toml --workflow .github/workflows/ci.yml` with the
+# release-tag commit, then set the matching release version on the
+# `@jsr/polymorph__test` dependency in
+# conformance/driver-ct/deltic/package.json and `npm install` there —
+# the cargo pins gate, the runner-js pin gate
+# (conformance-ct::runner-js-pin-check), and the CI ref guard fail on
+# skew.
 component-test-sdk = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4444a25a22106ad4128549bdc9e579552e62210" }
 
 aead = { version = "0.6", default-features = false, features = ["alloc"] }
diff --git a/conformance/driver-ct/deltic/.npmrc b/conformance/driver-ct/deltic/.npmrc
new file mode 100644
index 0000000..41583e3
--- /dev/null
+++ b/conformance/driver-ct/deltic/.npmrc
@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io
diff --git a/conformance/driver-ct/deltic/deno.json b/conformance/driver-ct/deltic/deno.json
index db70985..b2958e8 100644
--- a/conformance/driver-ct/deltic/deno.json
+++ b/conformance/driver-ct/deltic/deno.json
@@ -7,7 +7,7 @@
     "@deltic/wasi": "jsr:@deltic/wasi@0.1.0",
     "@deltic/translator": "jsr:@deltic/translator@0.1.0"
   },
-  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] },
+  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*", "jsr:@polymorph/*"] },
   "tasks": {
     "check": "deno check run.ts browser-bundle-entry.ts"
   }
diff --git a/conformance/driver-ct/deltic/deno.lock b/conformance/driver-ct/deltic/deno.lock
index d4d4405..ba387bc 100644
--- a/conformance/driver-ct/deltic/deno.lock
+++ b/conformance/driver-ct/deltic/deno.lock
@@ -7,6 +7,7 @@
     "jsr:@deltic/runtime@0.1.0": "0.1.0",
     "jsr:@deltic/translator@0.1.0": "0.1.0",
     "jsr:@deltic/wasi@0.1.0": "0.1.0",
+    "npm:@jsr/polymorph__test@0.1.1": "0.1.1",
     "npm:playwright-core@1.62.1": "1.62.1"
   },
   "jsr": {
@@ -40,6 +41,10 @@
     }
   },
   "npm": {
+    "@jsr/polymorph__test@0.1.1": {
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg==",
+      "tarball": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz"
+    },
     "playwright-core@1.62.1": {
       "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
       "bin": true
@@ -54,6 +59,7 @@
     ],
     "packageJson": {
       "dependencies": [
+        "npm:@jsr/polymorph__test@0.1.1",
         "npm:playwright-core@1.62.1"
       ]
     }
diff --git a/conformance/driver-ct/deltic/package-lock.json b/conformance/driver-ct/deltic/package-lock.json
index aa9a554..42c71d0 100644
--- a/conformance/driver-ct/deltic/package-lock.json
+++ b/conformance/driver-ct/deltic/package-lock.json
@@ -6,15 +6,14 @@
     "": {
       "name": "@polymorph/tls-conformance-deltic-browser",
       "dependencies": {
-        "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+        "@jsr/polymorph__test": "0.1.1",
         "playwright-core": "1.62.1"
       }
     },
-    "node_modules/@polymorph/component-test-js": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210",
-      "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==",
-      "license": "Apache-2.0 WITH LLVM-exception"
+    "node_modules/@jsr/polymorph__test": {
+      "version": "0.1.1",
+      "resolved": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz",
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg=="
     },
     "node_modules/playwright-core": {
       "version": "1.62.1",
diff --git a/conformance/driver-ct/deltic/package.json b/conformance/driver-ct/deltic/package.json
index 77d290e..a57caf7 100644
--- a/conformance/driver-ct/deltic/package.json
+++ b/conformance/driver-ct/deltic/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "description": "Node driver for the deltic-browser conformance rows: the composed artifacts runtime-linked inside headless Chromium through the upstream page driver and deltic worker.",
   "dependencies": {
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+    "@jsr/polymorph__test": "0.1.1",
     "playwright-core": "1.62.1"
   }
 }
diff --git a/conformance/driver-ct/deltic/run-browser.mjs b/conformance/driver-ct/deltic/run-browser.mjs
index 2a95b15..e56c7bd 100644
--- a/conformance/driver-ct/deltic/run-browser.mjs
+++ b/conformance/driver-ct/deltic/run-browser.mjs
@@ -1,7 +1,7 @@
 // The deltic-browser leg: both composed artifacts run runtime-linked
 // inside headless Chromium — the page, worker pool, stall watchdog, and
-// Chrome ladder all live in @polymorph/component-test-js, and the
-// upstream DELTIC worker (js/runner-deltic/browser-worker.mjs) loads the
+// Chrome ladder all live in @jsr/polymorph__test, and the
+// upstream DELTIC worker (runner-deltic/browser-worker.mjs) loads the
 // pinned deltic-embedder.mjs release asset and links the suite in the
 // browser: no transpile step, no generated tree. This file is the frame:
 // asset URL wiring, target configuration, and results-file writing —
@@ -28,8 +28,8 @@ import {
   findChrome,
   MOUNT,
   runPageHarness,
-} from "@polymorph/component-test-js/browser-driver";
-import { writeResultsFile } from "@polymorph/component-test-js/node-runner";
+} from "@jsr/polymorph__test/browser-driver";
+import { writeResultsFile } from "@jsr/polymorph__test/node-runner";
 
 const DELTIC_DIR = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = join(DELTIC_DIR, "..", "..", "..");
@@ -77,7 +77,7 @@ const outcome = await runPageHarness({
     title: "polymorph:tls conformance (deltic-browser)",
     config: {
       jobs: 1,
-      workerUrl: `${MOUNT}/js/runner-deltic/browser-worker.mjs`,
+      workerUrl: `${MOUNT}/runner-deltic/browser-worker.mjs`,
       suites: SUITES,
     },
   }),
diff --git a/conformance/driver-ct/justfile b/conformance/driver-ct/justfile
index 10f426d..6b1bb35 100644
--- a/conformance/driver-ct/justfile
+++ b/conformance/driver-ct/justfile
@@ -47,8 +47,10 @@ _ct-tools:
         cargo install --locked --root target/ct-tools --git "$url" --rev "$rev" component-test-cli component-test-runner
         printf '%s' "$rev" > target/ct-tools/.rev
     fi
+    # Cargo-side pin gate only: the JS runner core is version-pinned
+    # from JSR now (@jsr/polymorph__test), checked by its own gate
+    # (runner-js-pin-check below) rather than this rev-based check.
     {{ct}} pins --cargo-lock Cargo.lock \
-        --js-lock conformance/driver-ct/deltic/package-lock.json \
         --expect "$rev" > /dev/null
 
 # Check the committed case inventory against the built suite.
@@ -99,6 +101,27 @@ _deltic-pin-check:
     n=$(printf '%s\n' "$v" | sed '/^$/d' | wc -l)
     [ "$n" = 1 ] || { echo "deltic pin drift: $v" >&2; exit 1; }
 
+# The JS runner core's one-version gate: the deltic npm tree consuming
+# @jsr/polymorph__test (jsr:@polymorph/test through JSR's npm-compat
+# registry, per deltic/.npmrc) and deltic's own deno.lock (which also
+# tracks that package.json dependency) must agree on one resolved
+# version — a skewed bump runs the JS harness against a Rust runner
+# from a different polymorph-test release, a subtle contract-mismatch
+# generator.
+runner-js-pin-check:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    cd {{root}}
+    v=$({ jq -r '.packages["node_modules/@jsr/polymorph__test"].version' \
+        conformance/driver-ct/deltic/package-lock.json; \
+        jq -r '.npm | keys[]' conformance/driver-ct/deltic/deno.lock \
+        | grep '^@jsr/polymorph__test@' | sed 's/.*@//'; } | sort -u)
+    if [ "$v" = "null" ] || [ -z "$v" ] || [ "$(printf '%s\n' "$v" | wc -l)" != 1 ]; then
+        echo "runner-js pin drift: $v" >&2
+        exit 1
+    fi
+    echo "runner-js pin OK: @jsr/polymorph__test $v"
+
 # The composed artifact runtime-linked under deltic on stock Deno —
 # no transpile step, no generated tree, no engine flag (callback ABI).
 # The pin and the module-graph lock live in deltic/ (see its README).