diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 08e2cc6..29d85a1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -26,3 +26,22 @@ jobs:
         run: |
           chmod +x tests/test_sdlc.sh
           bash tests/test_sdlc.sh
+
+  # Real load validation: boots Home Assistant against the repo config and
+  # proves HA can parse + set up every integration (yamllint only proves the
+  # YAML parses; this catches unknown keys, bad Jinja, schema drift).
+  # Pinned to the version the box runs. Stub secrets are CI-only fixtures
+  # (tests/fixtures/secrets-stub.yaml) — never present on the live box.
+  config-check:
+    runs-on: ultix
+    container:
+      image: homeassistant/home-assistant:2026.8.3
+    steps:
+      - uses: actions/checkout@v4
+      - name: homeassistant check_config
+        run: |
+          cp tests/fixtures/secrets-stub.yaml secrets.yaml
+          python3 -m homeassistant --script check_config --config .
+          rc=$?
+          rm -f secrets.yaml home-assistant_v2.db home-assistant.log*
+          exit $rc
diff --git a/tests/fixtures/secrets-stub.yaml b/tests/fixtures/secrets-stub.yaml
new file mode 100644
index 0000000..4061fe5
--- /dev/null
+++ b/tests/fixtures/secrets-stub.yaml
@@ -0,0 +1,7 @@
+# CI-only stub for `homeassistant check_config` (see .gitea/workflows/ci.yml).
+# NEVER copied to the live box. Values are syntactically-valid placeholders.
+deploy_webhook_id: ci-stub-deploy-webhook
+doorman_scan_webhook_id: ci-stub-scan-webhook
+doorman_unlock_url: http://127.0.0.1:1/unlock-stub
+gitea_auth_header: token ci-stub-gitea-token
+kuma_push_url: http://127.0.0.1:1/push?status=up&msg=ci-stub