diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 1acbba9..7aa9273 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -91,6 +91,7 @@ jobs:
               if test -n "$previous_target"; then
                 cp -al "$previous_target" "$cargo_target"
                 rm -f -- "$cargo_target/.metacrate-ready"
+                touch "$cargo_target/.metacrate-cloned"
               else
                 mkdir -p "$cargo_target"
               fi
@@ -101,6 +102,7 @@ jobs:
               fi
             done < <(find "$cargo_cache_root" -mindepth 1 -maxdepth 1 -type d -name 'target-rust-1.97.1-aarch64-unknown-linux-gnu-*' -print0)
           ) 9>"$cargo_cache_root/required-target.lock"
+          test -f "$cargo_target/.metacrate-cloned" && cloned_target=true || cloned_target=false
           test -f "$cargo_target/.metacrate-ready" && cargo_hit=true || cargo_hit=false
           test -d "$CARGO_HOME/registry/cache" && dependency_hit=true || dependency_hit=false
           test -f "$openjpeg_prefix/metacrate-openjpeg.identity" && test -f "$skia_archive" && native_hit=true || native_hit=false
@@ -114,6 +116,7 @@ jobs:
           echo "METACRATE_DEPENDENCY_CACHE_HIT=$dependency_hit" >> "$GITHUB_ENV"
           echo "METACRATE_NATIVE_CACHE_HIT=$native_hit" >> "$GITHUB_ENV"
           echo "METACRATE_TOOLS_CACHE_HIT=$tools_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_CARGO_TARGET_CLONED=$cloned_target" >> "$GITHUB_ENV"
 
       - name: Install the single native prerequisite set
         run: |
@@ -157,6 +160,22 @@ jobs:
             python3 tools/normalize_git_mtimes.py --self-test
             python3 tools/normalize_git_mtimes.py --state "$CARGO_TARGET_DIR/.metacrate-mtimes.json"
             python3 tools/normalize_git_mtimes.py --state "$CARGO_TARGET_DIR/.metacrate-mtimes.json" --check
+            # Cargo does not fingerprint CARGO_TARGET_DIR in integration-test
+            # binaries. Invalidate only the relocated program integration-test
+            # fingerprints so CARGO_BIN_EXE_* cannot name the pruned directory.
+            if test "$METACRATE_CARGO_TARGET_CLONED" = true; then
+              fingerprint_root="$CARGO_TARGET_DIR/debug/.fingerprint"
+              fingerprint_list="$CARGO_TARGET_DIR/.metacrate-relocated-fingerprints"
+              if test -d "$fingerprint_root"; then
+                find "$fingerprint_root" -mindepth 2 -maxdepth 2 -type f \
+                  -path '*/libremetaverse-programs-*/*' \
+                  -name 'test-integration-test-*' -printf '%h\0' > "$fingerprint_list"
+                while IFS= read -r -d '' integration_fingerprint; do
+                  rm -rf -- "$integration_fingerprint"
+                done < "$fingerprint_list"
+              fi
+              rm -f -- "$fingerprint_list" "$CARGO_TARGET_DIR/.metacrate-cloned"
+            fi
             cargo run --locked -p metacrate-ci-matrix -- required-gate --evidence artifacts/ci/required-gate.json
             touch "$CARGO_TARGET_DIR/.metacrate-ready"
           ) 9>"$cache_lock"
diff --git a/release/DISTRIBUTION-MANIFEST.json b/release/DISTRIBUTION-MANIFEST.json
index 05f7cd5..2790927 100644
--- a/release/DISTRIBUTION-MANIFEST.json
+++ b/release/DISTRIBUTION-MANIFEST.json
@@ -17,8 +17,8 @@
     },
     {
       "path": ".gitea/workflows/ci.yml",
-      "bytes": 8705,
-      "sha256": "e259db6e8c619decc4c87e41d66bd16e1ee359d2485199f4de9eedad97abc170"
+      "bytes": 9946,
+      "sha256": "e32a0e2bc2240e6033babd106fbc13decd17a70df075ceb1d60dce53c0e23a34"
     },
     {
       "path": ".gitea/workflows/release.yml",
@@ -2637,8 +2637,8 @@
     },
     {
       "path": "tools/ci-matrix/src/ci_gate.rs",
-      "bytes": 45127,
-      "sha256": "02e0c6569efd7275296262bbc6e2c4b64d4dbe1afad8c9c85d02acc8f5155f4c"
+      "bytes": 45862,
+      "sha256": "89eff04b27bb60847714632ec1df004b05ea6f31da2b634a27396ee0a79473b4"
     },
     {
       "path": "tools/ci-matrix/src/dependency.rs",
diff --git a/tools/ci-matrix/src/ci_gate.rs b/tools/ci-matrix/src/ci_gate.rs
index d2763e3..20c1907 100644
--- a/tools/ci-matrix/src/ci_gate.rs
+++ b/tools/ci-matrix/src/ci_gate.rs
@@ -1047,12 +1047,22 @@ fn validate_workflows(root: &Path, manifest: &CoverageManifest) -> Result<()> {
         "flock --exclusive 9",
         "rm -f -- \"$cargo_target/.metacrate-ready\"",
         "rm -f -- \"$CARGO_TARGET_DIR/.metacrate-ready\"",
+        "touch \"$cargo_target/.metacrate-cloned\"",
         "stale_target",
         "python3 tools/normalize_git_mtimes.py --state",
         ".metacrate-mtimes.json\" --check",
         "'**/Cargo.toml'",
         "METACRATE_DEPENDENCY_CACHE_HIT",
         "cp -al \"$previous_target\" \"$cargo_target\"",
+        "METACRATE_CARGO_TARGET_CLONED=$cloned_target",
+        "if test \"$METACRATE_CARGO_TARGET_CLONED\" = true",
+        "fingerprint_root=\"$CARGO_TARGET_DIR/debug/.fingerprint\"",
+        "-path '*/libremetaverse-programs-*/*'",
+        "-name 'test-integration-test-*'",
+        "-printf '%h\\0' > \"$fingerprint_list\"",
+        "rm -rf -- \"$integration_fingerprint\"",
+        "done < \"$fingerprint_list\"",
+        "rm -f -- \"$fingerprint_list\" \"$CARGO_TARGET_DIR/.metacrate-cloned\"",
     ] {
         if !required.contains(marker) {
             return Err(MatrixError::new(format!(
@@ -1065,6 +1075,11 @@ fn validate_workflows(root: &Path, manifest: &CoverageManifest) -> Result<()> {
             "cold dependency/native validation must retain the keyed compiled target",
         ));
     }
+    if required.contains("cargo clean") {
+        return Err(MatrixError::new(
+            "cloned targets must retain reusable program and dependency artifacts",
+        ));
+    }
     if required.contains("rm -rf -- \"$CARGO_HOME/registry\"") {
         return Err(MatrixError::new(
             "cold validation must preserve immutable extracted sources for Cargo fingerprints",