diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7bfcc2b..bb014b5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,12 +9,32 @@ env:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
-          go-version: '1.26'
+          go-version-file: go.mod
       - name: Configure Git for private repos
+        if: ${{ secrets.RELEASES_TOKEN != '' }}
         run: git config --global url."https://x-access-token:${{ secrets.RELEASES_TOKEN }}@github.com/".insteadOf "https://github.com/"
       - run: go test -race ./...
       - run: go vet ./...
+
+  strict-contracts:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Configure Git for private repos
+        if: ${{ secrets.RELEASES_TOKEN != '' }}
+        run: git config --global url."https://x-access-token:${{ secrets.RELEASES_TOKEN }}@github.com/".insteadOf "https://github.com/"
+      - name: Validate strict plugin contracts
+        run: |
+          WFCTL_VERSION=$(go list -m -f '{{.Version}}' github.com/GoCodeAlone/workflow)
+          go run github.com/GoCodeAlone/workflow/cmd/wfctl@${WFCTL_VERSION} plugin validate --file plugin.json --strict-contracts
diff --git a/plugin.json b/plugin.json
new file mode 100644
index 0000000..f22a3c3
--- /dev/null
+++ b/plugin.json
@@ -0,0 +1,84 @@
+{
+  "name": "workflow-plugin-websocket",
+  "version": "0.5.4",
+  "author": "GoCodeAlone",
+  "description": "General-purpose WebSocket support for workflow applications",
+  "type": "external",
+  "tier": "community",
+  "license": "MIT",
+  "repository": "https://github.com/GoCodeAlone/workflow-plugin-websocket",
+  "homepage": "https://github.com/GoCodeAlone/workflow-plugin-websocket",
+  "minEngineVersion": "0.3.56",
+  "keywords": ["websocket", "ws", "realtime", "streaming"],
+  "capabilities": {
+    "moduleTypes": ["ws.server"],
+    "stepTypes": ["step.ws_send", "step.ws_close"],
+    "triggerTypes": ["websocket"]
+  },
+  "stepSchemas": [
+    {
+      "type": "step.ws_send",
+      "plugin": "workflow-plugin-websocket",
+      "description": "Send a text message to a WebSocket connection by connection ID.",
+      "configFields": [
+        {
+          "key": "connectionId",
+          "label": "Connection ID",
+          "type": "string",
+          "description": "The unique identifier of the WebSocket connection to send the message to.",
+          "required": true,
+          "placeholder": "{{ .connectionId }}"
+        },
+        {
+          "key": "message",
+          "label": "Message",
+          "type": "string",
+          "description": "The text message to send to the WebSocket connection.",
+          "required": true,
+          "placeholder": "Hello, world!"
+        }
+      ],
+      "outputs": [
+        {
+          "key": "sent",
+          "type": "boolean",
+          "description": "Whether the message was successfully sent to the connection."
+        },
+        {
+          "key": "error",
+          "type": "string",
+          "description": "Error message when the send failed (e.g. ws.server not initialized, missing connectionId).",
+          "optional": true
+        }
+      ]
+    },
+    {
+      "type": "step.ws_close",
+      "plugin": "workflow-plugin-websocket",
+      "description": "Close a WebSocket connection by connection ID.",
+      "configFields": [
+        {
+          "key": "connectionId",
+          "label": "Connection ID",
+          "type": "string",
+          "description": "The unique identifier of the WebSocket connection to close.",
+          "required": true,
+          "placeholder": "{{ .connectionId }}"
+        }
+      ],
+      "outputs": [
+        {
+          "key": "closed",
+          "type": "boolean",
+          "description": "Whether the connection was found and closed."
+        },
+        {
+          "key": "error",
+          "type": "string",
+          "description": "Error message when the close failed (e.g. ws.server not initialized).",
+          "optional": true
+        }
+      ]
+    }
+  ]
+}