diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2daad35..9b11260 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -33,12 +33,48 @@ jobs:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install package (generated-model tests import it)
         run: pip install -e .
       - name: Run preprocessing tests
         run: python -m unittest discover -s tests -p "test_*.py"
+
+  model-drift:
+    name: Generated models match the pinned UCP spec
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+      - name: Regenerate models from the pinned spec version
+        # SDK 0.4.x targets UCP 2026-04-08 (see the README compatibility
+        # table). Bump this pin together with the SDK version line.
+        run: ./generate_models.sh 2026-04-08
+      - name: Normalize file endings (as pre-commit's end-of-file-fixer does)
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+
+          for path in Path("src/ucp_sdk/models/schemas").rglob("*.py"):
+              text = path.read_text(encoding="utf-8")
+              fixed = text.rstrip("\n") + "\n" if text.strip() else ""
+              if fixed != text:
+                  path.write_text(fixed, encoding="utf-8")
+          PY
+      - name: Fail if regeneration does not reproduce the committed models
+        run: |
+          git add -A -- src/ucp_sdk/models/schemas
+          if ! git diff --cached --quiet -- src/ucp_sdk/models/schemas; then
+            echo "::error::Committed models differ from regeneration against the pinned UCP spec. Either the generation pipeline is broken, or the models were edited without regenerating. Run ./generate_models.sh 2026-04-08 and commit the result."
+            git --no-pager diff --cached --stat -- src/ucp_sdk/models/schemas
+            git --no-pager diff --cached -- src/ucp_sdk/models/schemas
+            exit 1
+          fi
+          echo "Committed models match regeneration."
diff --git a/pyproject.toml b/pyproject.toml
index df55948..0e49d63 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -27,7 +27,14 @@ dependencies = [
 
 [dependency-groups]
 dev = [
-    "datamodel-code-generator[http,ruff]>=0.50.0",
+    # Exact pins: the model-drift CI job regenerates the models against the
+    # pinned UCP spec and asserts byte-identical output, so the codegen
+    # toolchain must resolve reproducibly. (The floating ">=0.50.0" bound
+    # broke on 2026-08-03: datamodel-code-generator 0.72.0 mis-resolves the
+    # spec's remote $refs and emits incomplete models.) Bump these pins and
+    # regenerate the models in the same PR.
+    "datamodel-code-generator[http]==0.71.0",
+    "ruff==0.16.1",
 ]
 
 [build-system]