diff --git a/.github/workflows/build-blah2.yml b/.github/workflows/build-blah2.yml
index cdc4fcdb..37f82293 100644
--- a/.github/workflows/build-blah2.yml
+++ b/.github/workflows/build-blah2.yml
@@ -82,21 +82,20 @@ jobs:
           echo "Loaded images:"
           docker images | grep ${{ inputs.tag }}
 
-      - name: Run blah2 unit tests
+      # The unit tests now run inside the build stage (see Dockerfile), which is
+      # the only image that contains them. A failing test fails the build job,
+      # so there is nothing left to run here.
+      #
+      # This step used to run them against the runtime image, which ships the
+      # binary alone, so it always printed "No unit tests directory found" and
+      # exited 0. It reported success without executing a single test.
+      - name: Confirm the runtime image carries no test binaries
         run: |
-          echo "Running blah2 unit tests..."
-          docker run --rm blah2:${{ inputs.tag }} sh -c '
-            cd /opt/blah2/bin/test/unit 2>/dev/null || { echo "No unit tests directory found"; exit 0; }
-            TEST_COUNT=0
-            for test in *; do
-              if [ -x "$test" ] && [ -f "$test" ]; then
-                echo "Running: $test"
-                ./"$test" || exit 1
-                TEST_COUNT=$((TEST_COUNT + 1))
-              fi
-            done
-            echo "Ran $TEST_COUNT unit tests"
-          '
+          if docker run --rm blah2:${{ inputs.tag }} sh -c 'test -d /opt/blah2/bin/test/unit'; then
+            echo "Unexpected: test binaries shipped in the runtime image"
+            exit 1
+          fi
+          echo "Runtime image is test-free, as intended. Tests ran during the build."
 
       - name: Check image size
         run: |
diff --git a/Dockerfile b/Dockerfile
index 96a5702c..45d0057a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -114,6 +114,30 @@ RUN set -ex \
     && cp -v /opt/blah2/bin/blah2 /blah2/bin/ \
     && chmod +x /blah2/bin/blah2
 
+# Run the unit tests here, in the build stage, because this is the only image
+# that has them: the runtime stage deliberately ships the binary alone. The
+# workflow used to run them against the runtime image, where the directory does
+# not exist, and swallowed that with `exit 0`, so no test had ever actually
+# executed in CI.
+#
+# set -e means a failing test fails the build. The emptiness checks mean a
+# missing or empty test directory fails the build too, rather than passing
+# silently the way the old step did.
+RUN set -eu; \
+    cd /opt/blah2/bin/test/unit; \
+    if [ -z "$(ls -A .)" ]; then echo "FAIL: no unit tests were built"; exit 1; fi; \
+    export BLAH2_FFT_CACHE=/tmp/blah2-fft-length.cache; \
+    count=0; \
+    for t in *; do \
+      if [ -f "$t" ] && [ -x "$t" ]; then \
+        echo "==== $t ===="; \
+        ./"$t"; \
+        count=$((count+1)); \
+      fi; \
+    done; \
+    if [ "$count" -eq 0 ]; then echo "FAIL: no executable unit tests found"; exit 1; fi; \
+    echo "==== $count unit test binaries passed ===="
+
 WORKDIR /blah2/bin
 
 # =============================================================================