diff --git a/.gitea/workflows/private-modules.yaml b/.gitea/workflows/private-modules.yaml
index 8d34981..6125e97 100644
--- a/.gitea/workflows/private-modules.yaml
+++ b/.gitea/workflows/private-modules.yaml
@@ -11,4 +11,4 @@ jobs:
       - name: Canonical export and native offline boundaries
         run: |
           python3 -m unittest discover -s tests
-          CGO_ENABLED=1 GO111MODULE=off GOTOOLCHAIN=local GOFLAGS= go test -race ./tools/private-modules
+          docker build --network none --file tests/private-modules.Dockerfile tools/private-modules
diff --git a/README.md b/README.md
index ebc8599..12da3c5 100644
--- a/README.md
+++ b/README.md
@@ -96,6 +96,20 @@ input for public bases.
 |---|---|
 | `tag` | Numeric tag assigned (= `github.run_number`). |
 
+## Private module contract validation
+
+The private-module contract workflow runs its Go race tests in the digest-pinned
+standard Go compiler image in `tests/private-modules.Dockerfile`. The Fritzlab
+runner doesn't provide GCC. Only `tools/private-modules` enters that build context;
+the test runs with networking and module downloads disabled. The public compiler
+image must already be cached or obtainable through the existing image pull path.
+This check doesn't publish an image or change runner configuration.
+
+```sh
+python3 -m unittest discover -s tests
+docker build --network none --file tests/private-modules.Dockerfile tools/private-modules
+```
+
 ## Smoke test patterns
 
 Override entrypoint for a binary that expects no args:
diff --git a/tests/private-modules.Dockerfile b/tests/private-modules.Dockerfile
new file mode 100644
index 0000000..31edd39
--- /dev/null
+++ b/tests/private-modules.Dockerfile
@@ -0,0 +1,7 @@
+FROM golang:1.27.0-trixie@sha256:df98008ecd2b0ecc9f0a94d1b07e3564a9c92b555369b33d9b5f60d0765b2db7
+WORKDIR /contract
+# The runner intentionally needn't provide a C compiler for this race check.
+# The build context contains only the canonical Go tooling, without Git state.
+COPY *.go ./
+ENV CGO_ENABLED=1 GO111MODULE=off GOTOOLCHAIN=local GOFLAGS= GOPROXY=off GOSUMDB=off
+RUN go test -race -count=1 ./