diff --git a/.gitea/workflows/acceptance.yml b/.gitea/workflows/acceptance.yml
index ae8e8e46..b22117d4 100644
--- a/.gitea/workflows/acceptance.yml
+++ b/.gitea/workflows/acceptance.yml
@@ -44,6 +44,8 @@ jobs:
       - name: The developer protocol's evidence
         run: scripts/check_protocol.sh "${{ github.event.pull_request.head.sha || 'HEAD' }}"
 
+      # The gate into master refuses an unsigned build (#174; Captain Bob, 2026-11-12: "Yes, reject
+      # unsigned builds"). It warned and went on. scripts/test_acceptance_signing.sh runs this step.
       - name: The capsule-signing key
         env:
           KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
@@ -53,7 +55,8 @@ jobs:
             (umask 077; printf '%s\n' "$KEY" > "$f")
             echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
           else
-            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+            echo "::error::No CAPSULE_SIGN_KEY secret: the gate into master does not accept an unsigned build."
+            exit 1
           fi
 
       - name: Acceptance amd64
diff --git a/logs/20261112-185739/ci-tests/test_acceptance_signing.log b/logs/20261112-185739/ci-tests/test_acceptance_signing.log
new file mode 100644
index 00000000..30f82da7
--- /dev/null
+++ b/logs/20261112-185739/ci-tests/test_acceptance_signing.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5dddd639969cac6603fe54379a90b4fb97f7b913a2cdd422a6a562f2f709eb49
+size 496
diff --git a/scripts/test_acceptance_signing.sh b/scripts/test_acceptance_signing.sh
new file mode 100755
index 00000000..c2494ad2
--- /dev/null
+++ b/scripts/test_acceptance_signing.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-Starship-1.0
+# Copyright (c) 2023-2026 Robert A. James
+# test_acceptance_signing.sh -- #174: the PR gate into master refuses an unsigned build. The step
+# ".gitea/workflows/acceptance.yml: The capsule-signing key" is taken from the workflow as CI runs
+# it, and run here with and without CAPSULE_SIGN_KEY.
+#
+# Prints PASS:/FAIL: per check and RESULT:; exits 0 only if every check passes.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+T=$(mktemp -d)
+trap 'rm -rf "$T"' EXIT
+ok=1
+
+python3 - "$ROOT/.gitea/workflows/acceptance.yml" "$T/step.sh" <<'EOF' || { echo "FAIL: no 'The capsule-signing key' step in acceptance.yml"; exit 1; }
+import sys, yaml
+steps = yaml.safe_load(open(sys.argv[1]))["jobs"]["acceptance"]["steps"]
+run = [s["run"] for s in steps if s.get("name") == "The capsule-signing key"]
+assert len(run) == 1
+open(sys.argv[2], "w").write(run[0])
+EOF
+
+run_step() {  # run_step <key or empty>: the step's exit status; GITHUB_ENV and RUNNER_TEMP in $T
+    : > "$T/env"
+    KEY="$1" GITHUB_ENV="$T/env" RUNNER_TEMP="$T" bash -e "$T/step.sh" > "$T/out" 2>&1
+}
+
+if run_step ""; then echo "FAIL: #174 no CAPSULE_SIGN_KEY: the step passed -- an unsigned build would be accepted"; ok=0
+else echo "PASS: #174 no CAPSULE_SIGN_KEY: the step fails, the gate refuses the unsigned build"; fi
+grep -q "::error::" "$T/out" && echo "PASS: #174 and says so as an error" || { echo "FAIL: #174 no ::error:: line"; ok=0; }
+
+if run_step "-----BEGIN PRIVATE KEY----- test -----END PRIVATE KEY-----" && grep -q "^SIGN_KEY=$T/capsule-signing.key$" "$T/env" &&
+   [ -s "$T/capsule-signing.key" ]; then
+    echo "PASS: with a key: the step passes and hands it to the build (SIGN_KEY)"
+else echo "FAIL: with a key: the step did not pass, or did not set SIGN_KEY"; ok=0; fi
+
+echo "RESULT: $([ $ok = 1 ] && echo PASS || echo FAIL)"
+[ $ok = 1 ]