diff --git a/docs/release-control/v6/internal/subsystems/agent-lifecycle.md b/docs/release-control/v6/internal/subsystems/agent-lifecycle.md
index a102a69af..bb4938e60 100644
--- a/docs/release-control/v6/internal/subsystems/agent-lifecycle.md
+++ b/docs/release-control/v6/internal/subsystems/agent-lifecycle.md
@@ -7338,6 +7338,10 @@ standalone `secure-runtime-rootless-v1` receipt only after exact socket
 ownership, daemon rootless attestation, installer pinning, direct telemetry,
 same-family typed-helper fallback, recovery without collector restart,
 ambiguity refusal, authority isolation, and cleanup are recorded.
+The wrapper must compile every Go artifact with mandatory VCS stamping so a
+missing revision or unavailable clean-worktree proof fails before live evidence
+can be emitted; the receipt and validator retain the exact artifact hashes and
+source commit.
 Any failed runtime test must retain the disposable host's systemd journal and
 container log before strict nonce-bound cleanup; a missing receipt never
 silently substitutes for causal failure evidence.
diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index 1f5bd48a3..f7c02701f 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -278,7 +278,9 @@ Its standalone `secure-runtime-rootless-v1` receipt must bind the exact
 qualification, collector, helper, installer, source-manifest, socket,
 fresh-install, legacy-migration, restart, fallback, recovery, ambiguity,
 authority, and cleanup evidence before the independent validator can emit a
-local artifact-bound self-attestation. Checking in the harness or passing its
+local artifact-bound self-attestation. All three Go artifacts require explicit
+VCS stamping at build time; unavailable revision or clean-worktree metadata is
+a build failure rather than an attestable omission. Checking in the harness or passing its
 ordinary contract tests is not live qualification. Until a complete
 secret-free receipt and attestation are retained, this surface remains
 implemented-but-unqualified and cannot change the opt-in safe-profile default.
diff --git a/scripts/installtests/secure_runtime_rootless_qualification_test.go b/scripts/installtests/secure_runtime_rootless_qualification_test.go
index 56a9031c2..03b5af7ad 100644
--- a/scripts/installtests/secure_runtime_rootless_qualification_test.go
+++ b/scripts/installtests/secure_runtime_rootless_qualification_test.go
@@ -1605,6 +1605,9 @@ func TestRootlessQualificationGuardAndWrapperInvariants(t *testing.T) {
 			t.Fatalf("rootless qualification wrapper missing %q", required)
 		}
 	}
+	if count := strings.Count(script, `-buildvcs=true`); count != 3 {
+		t.Fatalf("rootless qualification wrapper must require VCS metadata for all three Go artifacts: got %d", count)
+	}
 	for _, forbidden := range []string{"/var/run/docker.sock:", "/run/podman/podman.sock:", "/sys/fs/cgroup:/sys/fs/cgroup", "--cgroupns=host", "-v $", "--volume"} {
 		if strings.Contains(script, forbidden) {
 			t.Fatalf("rootless qualification wrapper contains forbidden host-runtime mount marker %q", forbidden)
diff --git a/scripts/run-secure-runtime-rootless-qualification.sh b/scripts/run-secure-runtime-rootless-qualification.sh
index ee3d5f97f..907936b1f 100755
--- a/scripts/run-secure-runtime-rootless-qualification.sh
+++ b/scripts/run-secure-runtime-rootless-qualification.sh
@@ -152,9 +152,9 @@ helper_ldflags="$(cd "${REPO_ROOT}" && ./scripts/release_ldflags.sh agent --vers
 
 (
   cd "${REPO_ROOT}"
-  CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -ldflags "${agent_ldflags}" -o "${PACKET_DIR}/pulse-agent" ./cmd/pulse-agent
-  CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -ldflags "${helper_ldflags}" -o "${PACKET_DIR}/pulse-agent-helper" ./cmd/pulse-agent-helper
-  CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go test -c -trimpath -o "${PACKET_DIR}/dockeragent.test" ./scripts/installtests
+  CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -buildvcs=true -ldflags "${agent_ldflags}" -o "${PACKET_DIR}/pulse-agent" ./cmd/pulse-agent
+  CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go build -trimpath -buildvcs=true -ldflags "${helper_ldflags}" -o "${PACKET_DIR}/pulse-agent-helper" ./cmd/pulse-agent-helper
+  CGO_ENABLED=0 GOOS=linux GOARCH="$(go env GOARCH)" GOFLAGS= GOWORK=off go test -c -trimpath -buildvcs=true -o "${PACKET_DIR}/dockeragent.test" ./scripts/installtests
 )
 openssl pkeyutl -sign -rawin -inkey "${PACKET_DIR}/update-private.pem" -in "${PACKET_DIR}/pulse-agent" | openssl base64 -A >"${PACKET_DIR}/pulse-agent.sig"
 printf '\n' >>"${PACKET_DIR}/pulse-agent.sig"