diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e80f9fa..b7c6e20 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -21,7 +21,9 @@ jobs:
       - name: Install .NET SDK
         uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
-          dotnet-version: 10.0.301
+          dotnet-version: |
+            8.0.128
+            10.0.301
 
       - name: Restore locked dependencies
         run: dotnet restore Rendezvous.slnx --locked-mode
@@ -127,7 +129,9 @@ jobs:
       - name: Install .NET SDK
         uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
-          dotnet-version: 10.0.301
+          dotnet-version: |
+            8.0.128
+            10.0.301
 
       - name: Build deployment diagnostic
         run: |
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 5b86cbd..43f9836 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -20,10 +20,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install pinned .NET SDK
+      - name: Install pinned .NET SDKs
         uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
-          dotnet-version: 10.0.301
+          dotnet-version: |
+            8.0.128
+            10.0.301
 
       - name: Install pinned Buildx and BuildKit
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
diff --git a/README.md b/README.md
index 6596c24..7a8a232 100644
--- a/README.md
+++ b/README.md
@@ -134,8 +134,10 @@ external-network procedure are in
 
 ## Development
 
-The repository pins .NET SDK 10.0.301. From a clean clone, run the same gates as
-CI from the repository root:
+The repository pins .NET SDK 10.0.301. The full process-test gate also requires
+the .NET 8 runtime because the public TestClient deliberately targets `net8.0`;
+CI installs SDK 8.0.128 to supply the pinned 8.0.28 runtime. From a clean clone,
+run the same gates as CI from the repository root:
 
 ```bash
 dotnet restore Rendezvous.slnx --locked-mode
diff --git a/docs/architecture/project-boundaries.md b/docs/architecture/project-boundaries.md
index ae5f8f3..20fd962 100644
--- a/docs/architecture/project-boundaries.md
+++ b/docs/architecture/project-boundaries.md
@@ -29,6 +29,8 @@ engine, transport, or server dependency therefore fails the normal test gate.
 ## Supported toolchain
 
 - Build SDK: .NET SDK 10.0.301, pinned by `global.json`.
+- Verification runtime: .NET SDK 8.0.128 supplies the pinned .NET 8.0.28
+  runtime used by TestClient process tests and release verification.
 - Server runtime: .NET 10 LTS.
 - Client/contracts compatibility target: .NET Standard 2.1, consumable by the
   .NET 8-or-later runtime used by current Godot 4 C# projects.
diff --git a/eng/release-builder.Dockerfile b/eng/release-builder.Dockerfile
index 41c3df4..5e08ee2 100644
--- a/eng/release-builder.Dockerfile
+++ b/eng/release-builder.Dockerfile
@@ -1,11 +1,14 @@
 # syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
 FROM python:3.12.11-slim-bookworm@sha256:c00fc7b44d844b6da22861ec24af43968a5200eac4ec607b4725d585165d6b49 AS release-python
 FROM ghcr.io/jqlang/jq:1.8.1@sha256:95de8f005ca027686a1ca3b0853e2bb219062438015862816159f3f25a4d4230 AS release-jq
+FROM mcr.microsoft.com/dotnet/runtime:8.0.28-noble@sha256:19a311642eb7ee9c985bd71b9e5618123879df4e8d948f7388a41b0ee4788e25 AS dotnet-runtime-8
 
 FROM mcr.microsoft.com/dotnet/sdk:10.0.301-noble@sha256:ea8bde36c11b6e7eec2656d0e59101d4462f6bd630730f2c8201ed0572b295d5 AS release-builder
 COPY --from=release-python /usr/local/ /usr/local/
 COPY --from=release-jq /jq /usr/local/bin/jq
+COPY --from=dotnet-runtime-8 /usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.28/ /usr/share/dotnet/shared/Microsoft.NETCore.App/8.0.28/
 RUN dotnet --version \
+    && dotnet --list-runtimes \
     && python3 --version \
     && git --version \
     && tar --version \
diff --git a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
index e565cda..e8e60e5 100644
--- a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
+++ b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
@@ -149,6 +149,21 @@ public sealed class ReleaseCompatibilityTests
         Assert.Contains("<PackageReference Remove=\"FinalFactory.Rendezvous.Contracts\" />", realConsumerGate, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public void AutomationProvidesNet8RuntimeForProcessVerification()
+    {
+        string root = FindRepositoryRoot();
+        string qualityWorkflow = File.ReadAllText(Path.Combine(root, ".gitea/workflows/ci.yml"));
+        Assert.Equal(2, qualityWorkflow.Split("8.0.128", StringSplitOptions.None).Length - 1);
+
+        string releaseWorkflow = File.ReadAllText(Path.Combine(root, ".gitea/workflows/release.yml"));
+        Assert.Contains("8.0.128", releaseWorkflow, StringComparison.Ordinal);
+
+        string releaseBuilder = File.ReadAllText(Path.Combine(root, "eng/release-builder.Dockerfile"));
+        Assert.Contains("runtime:8.0.28-noble@sha256:", releaseBuilder, StringComparison.Ordinal);
+        Assert.Contains("Microsoft.NETCore.App/8.0.28", releaseBuilder, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void ServerSourceManifestIsCompleteSortedAndDeterministic()
     {