diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 161c292..7f23afb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -38,7 +38,7 @@ jobs:
         with:
           python-version: '3.x'
       - name: install the test runner
-        run: python3 -m pip install --disable-pip-version-check pytest==8.3.4
+        run: 'python3 -m pip install --disable-pip-version-check --only-binary=:all: pytest==8.3.4'
       - name: guard launch mode and repository hygiene
         env:
           GIT_AUTHOR_NAME: openRepoTools CI
diff --git a/specs/003-binary-only-guard-runner/plan.md b/specs/003-binary-only-guard-runner/plan.md
new file mode 100644
index 0000000..7064e6a
--- /dev/null
+++ b/specs/003-binary-only-guard-runner/plan.md
@@ -0,0 +1,6 @@
+# Plan
+
+Add pip's `--only-binary=:all:` flag to the focused guard job, preserving the
+pinned runner version and canonical test wrapper. Validate through that focused
+CI job and Sonar analysis. This is an implementation correction within the
+existing guard change, so it adds no separate OpenSpec governance proposal.
diff --git a/specs/003-binary-only-guard-runner/spec.md b/specs/003-binary-only-guard-runner/spec.md
new file mode 100644
index 0000000..80b87e7
--- /dev/null
+++ b/specs/003-binary-only-guard-runner/spec.md
@@ -0,0 +1,6 @@
+# Feature: Install the focused guard test runner from wheels
+
+Follow-up to feature `002-skip-no-lane-guard` and PR #135. A late Sonar review
+flagged the new focused job's ability to execute package source build scripts.
+Require binary distributions for its pinned pytest installation. Runtime guard
+behavior and vendored command bytes do not change.
diff --git a/specs/003-binary-only-guard-runner/tasks.md b/specs/003-binary-only-guard-runner/tasks.md
new file mode 100644
index 0000000..c999c81
--- /dev/null
+++ b/specs/003-binary-only-guard-runner/tasks.md
@@ -0,0 +1,8 @@
+# Tasks
+
+- [x] T001 Restrict the focused test-runner installation to binary distributions.
+
+## Verification
+
+The diff changes the new focused job's install command only. CI verifies the
+wheel installation and reruns the same canonical 165-check guard/hygiene suite.