diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8ff6448..6c45b70 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -38,6 +38,9 @@ jobs:
       - name: Run tests
         run: ./scripts/test.sh
 
+      - name: Run container smoke test
+        run: ./tests/container-smoke.sh
+
   build:
     name: Build and publish
     needs: test
diff --git a/tests/workflow-contract.sh b/tests/workflow-contract.sh
index 01594ca..9d7df2f 100755
--- a/tests/workflow-contract.sh
+++ b/tests/workflow-contract.sh
@@ -13,6 +13,7 @@ grep -F 'packages: write' "$workflow" >/dev/null
 grep -F 'ghcr.io/${{ github.repository }}' "$workflow" >/dev/null
 grep -F 'platforms: linux/amd64' "$workflow" >/dev/null
 grep -F 'needs: test' "$workflow" >/dev/null
+grep -F 'run: ./tests/container-smoke.sh' "$workflow" >/dev/null
 grep -F 'cache-to: type=gha,mode=max,ignore-error=true' "$workflow" >/dev/null
 # Match the GitHub expression literally.
 # shellcheck disable=SC2016