diff --git a/.github/workflows/quota-router-python.yml b/.github/workflows/quota-router-python.yml
index 0c5cae2a..f075dce4 100644
--- a/.github/workflows/quota-router-python.yml
+++ b/.github/workflows/quota-router-python.yml
@@ -75,6 +75,17 @@ jobs:
         with:
           python-version: '3.12'
 
+      # Install Rust explicitly. Without this, `maturin develop` below
+      # tries to bootstrap its own rustc via rustup and fails on fresh
+      # runners with:
+      #   error: failed to install component: 'clippy-preview-x86_64-unknown-linux-gnu',
+      #          detected conflict: 'bin/cargo-clippy'
+      # The `test` job above has the same step and works; this job was
+      # missing it. Pinning `dtolnay/rust-toolchain@stable` matches
+      # the `test` job exactly and gives maturin a clean rustup to use.
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
       # See note above on explicit venv creation.
       - name: Create venv and install mypy
         run: |
@@ -110,6 +121,18 @@ jobs:
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
+        with:
+          # dtolnay/rust-toolchain defaults to `--profile minimal`, which
+          # installs only rustc (no cargo, no clippy, no rustfmt). The
+          # `test` and `type-check` jobs in this workflow happen to work
+          # because their runners have cargo pre-installed in the Ubuntu
+          # image. The `build` job hit a fresh runner without that, and
+          # maturin failed with:
+          #   error: 'cargo' is not installed for the toolchain '1.96.0-x86_64-unknown-linux-gnu'
+          # Switching to `profile: default` installs cargo (and clippy,
+          # rustfmt, rust-docs) explicitly via rustup, making the build
+          # job self-sufficient regardless of the runner image.
+          profile: default
 
       - name: Install maturin
         run: pip install --upgrade pip && pip install maturin
diff --git a/crates/octo-adapter-telegram/Cargo.toml b/crates/octo-adapter-telegram/Cargo.toml
index 82aa2dd2..df1d805f 100644
--- a/crates/octo-adapter-telegram/Cargo.toml
+++ b/crates/octo-adapter-telegram/Cargo.toml
@@ -64,5 +64,3 @@ tempfile = { version = "3.10", optional = true }
 tokio = { version = "1.35", features = ["test-util"] }
 serde_yaml = "0.9"
 ed25519-dalek = "2"
-# tracing setup in live_session_test (env-filter for RUST_LOG control)
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
diff --git a/live-tests/octo-telegram-live-tests/.gitignore b/live-tests/octo-telegram-live-tests/.gitignore
new file mode 100644
index 00000000..2c96eb1b
--- /dev/null
+++ b/live-tests/octo-telegram-live-tests/.gitignore
@@ -0,0 +1,2 @@
+target/
+Cargo.lock
diff --git a/live-tests/octo-telegram-live-tests/Cargo.toml b/live-tests/octo-telegram-live-tests/Cargo.toml
new file mode 100644
index 00000000..0bd79596
--- /dev/null
+++ b/live-tests/octo-telegram-live-tests/Cargo.toml
@@ -0,0 +1,29 @@
+[workspace]
+# Empty workspace table — declares this directory a standalone package
+# (NOT a member of the parent workspace at the repo root). This is what
+# physically keeps `cargo test --workspace` from the root from ever
+# building or running these tests.
+
+[package]
+name = "octo-telegram-live-tests"
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Live integration tests for octo-adapter-telegram against a real TDLib session. Intentionally NOT a workspace member — see docs/ and the crate's README below. Run with: cd live-tests/octo-telegram-live-tests && cargo test -- --ignored --nocapture --test-threads=1"
+
+# This crate is NOT in the main workspace on purpose:
+#   1. CI's `cargo test --workspace` from the repo root must never build or
+#      run these tests. A live Telegram session, mounted data dir, and
+#      working TDLib shared library are all required.
+#   2. The main workspace's `octo-adapter-telegram` is built with `real-tdlib`
+#      enabled transitively (via `octo-telegram-onboard-core`'s feature
+#      unification), so any test file inside its `tests/` would be auto-built
+#      by `cargo test --workspace` regardless of feature gates. Moving the
+#      live test here physically separates it from the CI build path.
+# To run:  cd live-tests/octo-telegram-live-tests && cargo test -- --ignored --nocapture --test-threads=1
+
+[dependencies]
+octo-adapter-telegram = { path = "../../crates/octo-adapter-telegram", features = ["real-tdlib"] }
+octo-network = { path = "../../crates/octo-network" }
+tokio = { version = "1.35", features = ["rt-multi-thread", "macros", "time", "sync"] }
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
diff --git a/live-tests/octo-telegram-live-tests/src/lib.rs b/live-tests/octo-telegram-live-tests/src/lib.rs
new file mode 100644
index 00000000..df2d5b8a
--- /dev/null
+++ b/live-tests/octo-telegram-live-tests/src/lib.rs
@@ -0,0 +1,5 @@
+//! Marker library for the live-tests crate. This crate only exists to host
+//! integration tests under `tests/`; it has no library API of its own.
+//!
+//! See `tests/live_session_test.rs` for the actual tests, and `Cargo.toml`
+//! for why this crate is intentionally outside the main workspace.
diff --git a/crates/octo-adapter-telegram/tests/live_session_test.rs b/live-tests/octo-telegram-live-tests/tests/live_session_test.rs
similarity index 100%
rename from crates/octo-adapter-telegram/tests/live_session_test.rs
rename to live-tests/octo-telegram-live-tests/tests/live_session_test.rs