diff --git a/.github/workflows/builder-images.yml b/.github/workflows/builder-images.yml
index 64528135..db2bb080 100644
--- a/.github/workflows/builder-images.yml
+++ b/.github/workflows/builder-images.yml
@@ -13,16 +13,52 @@ on:
       - tests/build-isolation.sh
       - .github/workflows/builder-images.yml
   workflow_dispatch:
+  pull_request:
+    paths:
+      - build/**
+      - bin/builder-image
+      - helpers/paths.sh
+      - helpers/docker-helpers.sh
+      - tests/build-isolation.sh
+      - .github/workflows/builder-images.yml
 
 # Complete each refresh before another can replace its tested image tags.
 concurrency:
-  group: builder-images
+  group: builder-images-${{ github.event.pull_request.number || 'master' }}
   cancel-in-progress: false
 
 permissions:
   contents: read
 
 jobs:
+  # Exercise proposed image changes on native runners with a read-only token.
+  # Publishing is a separate master-only job with its own write permission.
+  validate:
+    if: github.event_name == 'pull_request'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    env:
+      CONTAINER_ENGINE: docker
+      CANDIDATE_IMAGE: omarchy-builder-candidate:${{ matrix.arch }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Build a fresh environment
+        run: bin/builder-image build --arch "${{ matrix.arch }}" --mirror edge --tag "$CANDIDATE_IMAGE" --fresh
+      - name: Test isolated package builds
+        env:
+          TEST_BUILDER_IMAGE: ${{ env.CANDIDATE_IMAGE }}
+        run: tests/build-isolation.sh
+
   refresh:
     if: github.repository == 'omacom/omarchy-pkgs' && github.ref == 'refs/heads/master'
     strategy:
diff --git a/README.md b/README.md
index 5089dd77..8823595e 100644
--- a/README.md
+++ b/README.md
@@ -834,6 +834,8 @@ package-builder pool. Each candidate must pass `tests/build-isolation.sh`,
 including real package builds, before publication to
 `ghcr.io/omacom/omarchy-pkg-builder`. Only `master` in this repository can
 publish; PR workflows cannot replace the shared images.
+PRs that change image inputs also build and test both candidates on native
+runners, with a read-only token and no registry publication.
 
 The compatibility tag contains the architecture, mirror, and a hash of the
 entire `build/` context, including executable bits and symlink targets but