diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6e5280c..57d0623 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,3 +40,23 @@ jobs:
 
       - name: Run Tests and Verifications
         run: mvn --batch-mode clean verify
+
+  xerial-control:
+    # Reference probe, not a parity gate: the same vendored tests run against the pinned
+    # xerial driver. A failure means the vendored test is not a valid reference or the
+    # driver diverges without a recorded reason, not that libSQL must match xerial.
+    name: Xerial Control (reference probe)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Amazon Corretto 25
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'corretto'
+          java-version: '25'
+          cache: 'maven'
+
+      - name: Run the xerial control profile
+        run: mvn --batch-mode -pl libsql-conformance -am -Pxerial-control verify
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2d22618..c9d101a 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -40,3 +40,23 @@ jobs:
 
       - name: Run Tests and Verifications
         run: mvn --batch-mode clean verify
+
+  xerial-control:
+    # Reference probe, not a parity gate: the same vendored tests run against the pinned
+    # xerial driver. A failure means the vendored test is not a valid reference or the
+    # driver diverges without a recorded reason, not that libSQL must match xerial.
+    name: Xerial Control (reference probe)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Amazon Corretto 25
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'corretto'
+          java-version: '25'
+          cache: 'maven'
+
+      - name: Run the xerial control profile
+        run: mvn --batch-mode -pl libsql-conformance -am -Pxerial-control verify
diff --git a/libsql-conformance/pom.xml b/libsql-conformance/pom.xml
index 9389524..21f9525 100644
--- a/libsql-conformance/pom.xml
+++ b/libsql-conformance/pom.xml
@@ -16,6 +16,10 @@
     <properties>
         <docker.config.dir>${project.build.directory}/docker-config</docker.config.dir>
         <xerial.version>3.53.4.0</xerial.version>
+        <!-- Set only by the xerial-control profile; the guard below rejects a hand-set
+             conformance.control.driver, because the control run must stay a reference
+             probe selected by the profile rather than a per-build driver switch. -->
+        <xerial.control.profile.active>false</xerial.control.profile.active>
     </properties>
 
     <dependencies>
@@ -82,6 +86,30 @@
                 <artifactId>maven-antrun-plugin</artifactId>
                 <version>3.2.0</version>
                 <executions>
+                    <execution>
+                        <id>guard-control-driver</id>
+                        <phase>generate-test-sources</phase>
+                        <goals>
+                            <goal>run</goal>
+                        </goals>
+                        <configuration>
+                            <target>
+                                <condition property="conformance.control.misconfigured">
+                                    <and>
+                                        <isset property="conformance.control.driver" />
+                                        <not>
+                                            <equals
+                                                arg1="${xerial.control.profile.active}"
+                                                arg2="true" />
+                                        </not>
+                                    </and>
+                                </condition>
+                                <fail
+                                    if="conformance.control.misconfigured"
+                                    message="conformance.control.driver is only set by the xerial-control profile. Run with -Pxerial-control instead of passing -Dconformance.control.driver, so the control run stays a reference probe." />
+                            </target>
+                        </configuration>
+                    </execution>
                     <execution>
                         <id>verify-vendored-upstream</id>
                         <phase>generate-test-sources</phase>
@@ -164,6 +192,9 @@
         -->
         <profile>
             <id>xerial-control</id>
+            <properties>
+                <xerial.control.profile.active>true</xerial.control.profile.active>
+            </properties>
             <dependencies>
                 <dependency>
                     <groupId>org.xerial</groupId>