diff --git a/package.json b/package.json
index c6131b7..af7fd8b 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,8 @@
     ".github/workflows/stack-*.yml",
     ".github/workflows/commitlint.yml",
     ".github/workflows/release-please.yml",
-    ".github/workflows/repokeeper-check.yml"
+    ".github/workflows/repokeeper-check.yml",
+    ".github/workflows/repokeeper-update.yml"
   ],
   "engines": {
     "node": ">=22.12.0"
diff --git a/test/package-files.test.ts b/test/package-files.test.ts
new file mode 100644
index 0000000..d8dbec3
--- /dev/null
+++ b/test/package-files.test.ts
@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+import { listWorkflows } from "../src/templates.js";
+
+const { files } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { files: string[] };
+
+/** Whether a `files` entry of package.json covers `path`; `*` stands for part of one file name. */
+const shipped = (path: string) =>
+  files.some((pattern) => {
+    const source = pattern
+      .split("*")
+      .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&"))
+      .join("[^/]*");
+    return new RegExp(`^${source}$`).test(path);
+  });
+
+describe("the published package", () => {
+  it("ships every reusable workflow a repository can be given a copy of", () => {
+    // `github.workflows.source: local` reads them from the installed package, not from the repository
+    const missing = listWorkflows().filter((name) => !shipped(`.github/workflows/${name}`));
+    expect(missing).toEqual([]);
+  });
+});