diff --git a/.skeleton/review-lock.json b/.skeleton/review-lock.json
index 52de664..8b0858a 100644
--- a/.skeleton/review-lock.json
+++ b/.skeleton/review-lock.json
@@ -14,7 +14,7 @@
 			"reviewedAt": "2026-09-02",
 			"documentHash": "sha256:f3059ccf7ba993212a97be4e628e3e4c7688739036e7b0151b2005f8dcb4393b",
 			"reviewDependencies": {
-				"package.json": "sha256:4d014adbf60f1b00f7750432da912f611d3fedd660956090b5525cb89cc639a7",
+				"package.json": "sha256:33c803d5fc5280994f12cf4b3e69c7706378d111dbd3a026b092f742b6d99c04",
 				"src/cli.ts": "sha256:1fc7a773f0295fd209a4d3baed536c24dc7bdf3d3c079118dad6f94a2de6026a"
 			}
 		},
@@ -22,7 +22,7 @@
 			"reviewedAt": "2026-09-02",
 			"documentHash": "sha256:265b48daf1265ce64be229be53c5545c43dc882585cb2e96f6858fc0410d182d",
 			"reviewDependencies": {
-				"package.json": "sha256:4d014adbf60f1b00f7750432da912f611d3fedd660956090b5525cb89cc639a7",
+				"package.json": "sha256:33c803d5fc5280994f12cf4b3e69c7706378d111dbd3a026b092f742b6d99c04",
 				"src/cli.ts": "sha256:1fc7a773f0295fd209a4d3baed536c24dc7bdf3d3c079118dad6f94a2de6026a"
 			}
 		},
diff --git a/package.json b/package.json
index f2f04ee..505e5b4 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
 	"description": "SSOT audit CLI for agent harness repos",
 	"type": "module",
 	"bin": {
-		"skeleton": "./dist/cli.js"
+		"skeleton": "dist/cli.js"
 	},
 	"exports": {
 		"./plugin-types": {
diff --git a/scripts/verify-package.ts b/scripts/verify-package.ts
index 5556e00..ed7724a 100644
--- a/scripts/verify-package.ts
+++ b/scripts/verify-package.ts
@@ -103,8 +103,12 @@ void [rule, audit.reviewProof.status];
 	run({ command: "node", args: [join(packageDir, "dist", "cli.js"), "--help"], cwd: consumer });
 
 	const packageJson = JSON.parse(readFileSync(join(packageDir, "package.json"), "utf8")) as {
+		bin?: Record<string, string>;
 		exports?: Record<string, unknown>;
 	};
+	if (packageJson.bin?.skeleton !== "dist/cli.js") {
+		throw new Error("Packed package is missing the skeleton CLI bin mapping");
+	}
 	for (const key of ["./plugin-types", "./result-types", "./schemas/result.schema.json"]) {
 		if (!(key in (packageJson.exports ?? {}))) throw new Error(`Packed exports missing ${key}`);
 	}