diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 18273e52..a1f11f99 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -256,6 +256,33 @@ jobs:
         name: admin-ui
         path: dist
 
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.26'
+        cache: true
+
+    - name: Generate grpc-versions.txt
+      # Cross-repo dep-sync foundation per
+      # docs/plans/2026-05-10-strict-contracts-force-cutover.md Task 2.
+      # Downstream plugins (e.g. workflow-plugin-digitalocean) gate their
+      # protoc / proto-gen toolchain pins against this artifact so they
+      # link against gRPC/protobuf versions ABI-compatible with this
+      # workflow release.
+      run: |
+        set -euo pipefail
+        # protoc-gen-go ships from the google.golang.org/protobuf module
+        # (path google.golang.org/protobuf/cmd/protoc-gen-go is NOT a
+        # standalone module), so its version line resolves against the
+        # parent module — same Version, intentional dedup, not a copy-paste.
+        {
+          echo "grpc=$(go list -m -json google.golang.org/grpc | jq -r .Version)"
+          echo "protobuf=$(go list -m -json google.golang.org/protobuf | jq -r .Version)"
+          echo "protoc-gen-go=$(go list -m -json google.golang.org/protobuf | jq -r .Version)"
+          echo "protoc-gen-go-grpc=$(go list -m -json google.golang.org/grpc/cmd/protoc-gen-go-grpc | jq -r .Version)"
+        } > dist/grpc-versions.txt
+        cat dist/grpc-versions.txt
+
     - name: Create checksums
       run: |
         cd dist
diff --git a/example/go.mod b/example/go.mod
index 67383ef3..99dc0e51 100644
--- a/example/go.mod
+++ b/example/go.mod
@@ -232,6 +232,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260420184626-e10c466a9529 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 // indirect
 	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
diff --git a/example/go.sum b/example/go.sum
index 1b47cd7a..a9205a20 100644
--- a/example/go.sum
+++ b/example/go.sum
@@ -826,6 +826,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/go.mod b/go.mod
index 1c5cb284..9f797c19 100644
--- a/go.mod
+++ b/go.mod
@@ -79,6 +79,7 @@ require (
 	golang.org/x/tools v0.44.0
 	google.golang.org/api v0.272.0
 	google.golang.org/grpc v1.80.0
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.35.4
diff --git a/go.sum b/go.sum
index b348bb85..4d7b7175 100644
--- a/go.sum
+++ b/go.sum
@@ -980,6 +980,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260420184626-e10c466a9529/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1 h1:/WILD1UcXj/ujCxgoL/DvRgt2CP3txG8+FwkUbb9110=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1/go.mod h1:YNKnb2OAApgYn2oYY47Rn7alMr1zWjb2U8Q0aoGWiNc=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/tools.go b/tools.go
new file mode 100644
index 00000000..89f006fb
--- /dev/null
+++ b/tools.go
@@ -0,0 +1,17 @@
+//go:build tools
+// +build tools
+
+// This file pins build-time tool dependencies that are not imported by
+// runtime code. Listed here so `go mod tidy` keeps them in go.mod/go.sum and
+// so the release pipeline can resolve their exact versions for the
+// grpc-versions.txt artifact (cross-repo dep sync foundation per
+// 2026-05-10-strict-contracts-force-cutover Task 2).
+//
+// Guarded by the `tools` build tag so it is excluded from normal builds
+// (avoids package-name conflict with the rest of the workflow root).
+package workflow
+
+import (
+	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
+	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
+)