diff --git a/.config/make/check.mak b/.config/make/check.mak
index d0bbd3925..b9288618e 100644
--- a/.config/make/check.mak
+++ b/.config/make/check.mak
@@ -11,14 +11,16 @@ check-%:
 
 # Warning-only check
 # Checks for optional dependencies and issues a warning if not found
-# (e.g., cargo-nextest for enhanced testing)
 warn-%:
 	@command -v $* >/dev/null 2>&1 || { \
 		echo >&2 "⚠️ '$*' is not installed."; \
 	}
 
 # For checking dependencies use check-<dep-name> or warn-<dep-name>
-.PHONY: core-deps fmt-deps test-deps
+#
+# NOTE: cargo-nextest is a HARD dependency of `make test`, gated inside the
+# test recipe itself (with a RUSTFS_ALLOW_CARGO_TEST_FALLBACK=1 escape hatch)
+# rather than a warn-only prerequisite here — see .config/make/tests.mak.
+.PHONY: core-deps fmt-deps
 core-deps: check-cargo ## Check core dependencies
 fmt-deps: check-rustfmt ## Check lint and formatting dependencies
-test-deps: warn-cargo-nextest ## Check tests dependencies
diff --git a/.config/make/tests.mak b/.config/make/tests.mak
index 13bfbe5f4..d0424f80c 100644
--- a/.config/make/tests.mak
+++ b/.config/make/tests.mak
@@ -2,6 +2,25 @@
 
 TEST_THREADS ?= 1
 
+# cargo-nextest is a HARD dependency of `make test`.
+#
+# nextest changes test semantics vs plain `cargo test`: it runs every test in
+# its own process (so serial_test's #[serial] mutex does not serialize across
+# tests) and it is the only runner that honours .config/nextest.toml
+# [test-groups] (e.g. the ecstore-serial-flaky serialization guard). CI runs
+# nextest (.github/actions/setup/action.yml installs it), so a silent fallback
+# to `cargo test` would run with different serialization behaviour than CI and
+# mask (or invent) flakes.
+#
+# Installing cargo-nextest:
+#   cargo install cargo-nextest --locked          # from source
+#   # or a prebuilt binary (faster) via the taiki-e installer / get.nexte.st:
+#   #   https://nexte.st/docs/installation/
+#
+# Escape hatch: set RUSTFS_ALLOW_CARGO_TEST_FALLBACK=1 to run the plain
+# `cargo test` fallback anyway. Results are NOT authoritative — semantics
+# differ from CI and .config/nextest.toml test-groups will NOT apply.
+
 .PHONY: script-tests
 script-tests: ## Run shell script tests
 	@echo "Running script tests..."
@@ -9,13 +28,38 @@ script-tests: ## Run shell script tests
 	./scripts/test_entrypoint_credentials.sh
 
 .PHONY: test
-test: core-deps test-deps script-tests ## Run all tests
+test: core-deps script-tests ## Run all tests (needs cargo-nextest; RUSTFS_ALLOW_CARGO_TEST_FALLBACK=1 to override)
 	@echo "🧪 Running tests..."
 	@if command -v cargo-nextest >/dev/null 2>&1; then \
 		cargo nextest run --all --exclude e2e_test; \
-	else \
-		echo "ℹ️ cargo-nextest not found; falling back to 'cargo test'"; \
+	elif [ "$${RUSTFS_ALLOW_CARGO_TEST_FALLBACK:-0}" = "1" ]; then \
+		echo >&2 "⚠️  ============================================================================"; \
+		echo >&2 "⚠️  cargo-nextest NOT found — running the 'cargo test' fallback (opt-in)."; \
+		echo >&2 "⚠️  TEST SEMANTICS DIFFER FROM CI; results are NOT authoritative:"; \
+		echo >&2 "⚠️    * nextest runs each test in its own process; 'cargo test' does not,"; \
+		echo >&2 "⚠️      so serial_test #[serial] serialization behaves differently."; \
+		echo >&2 "⚠️    * .config/nextest.toml [test-groups] will NOT apply (e.g. the"; \
+		echo >&2 "⚠️      ecstore-serial-flaky group), so load-sensitive tests may flake here"; \
+		echo >&2 "⚠️      but pass on CI (or vice versa)."; \
+		echo >&2 "⚠️  Install cargo-nextest and re-run before trusting these results."; \
+		echo >&2 "⚠️  ============================================================================"; \
 		cargo test --workspace --exclude e2e_test -- --nocapture --test-threads="$(TEST_THREADS)"; \
+	else \
+		echo >&2 "❌ cargo-nextest is required for 'make test' but was not found."; \
+		echo >&2 ""; \
+		echo >&2 "   RustFS tests run under cargo-nextest (process-per-test isolation)."; \
+		echo >&2 "   CI runs nextest and .config/nextest.toml [test-groups] only take effect"; \
+		echo >&2 "   under nextest. Plain 'cargo test' has different serialization semantics"; \
+		echo >&2 "   and is NOT a faithful substitute."; \
+		echo >&2 ""; \
+		echo >&2 "   Install it with either:"; \
+		echo >&2 "     cargo install cargo-nextest --locked"; \
+		echo >&2 "   or a prebuilt binary (faster) — see https://nexte.st/docs/installation/"; \
+		echo >&2 ""; \
+		echo >&2 "   To run the plain 'cargo test' fallback anyway (results NOT authoritative;"; \
+		echo >&2 "   serialization semantics differ from CI), re-run with:"; \
+		echo >&2 "     RUSTFS_ALLOW_CARGO_TEST_FALLBACK=1 make test"; \
+		exit 1; \
 	fi
 	cargo test --all --doc
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3f19f1288..ea2051fe0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -66,6 +66,9 @@ make pre-commit
 make pre-pr
 ```
 
+> `make test` requires [cargo-nextest](https://nexte.st) (CI runs it and only nextest honours `.config/nextest.toml` test-groups). Install it with `cargo install cargo-nextest --locked` or a prebuilt binary (see https://nexte.st/docs/installation/). To run the plain `cargo test` fallback anyway (results not authoritative — serialization semantics differ from CI), set `RUSTFS_ALLOW_CARGO_TEST_FALLBACK=1`.
+
+### 🔒 Automated Pre-commit Hooks
 #### What `make pre-commit` and `make pre-pr` actually run
 
 `make pre-commit` is the **fast** gate. It runs, in order