diff --git a/deploy/ampel-ci.yml b/deploy/ampel-ci.yml
index 11036f4..2aab476 100644
--- a/deploy/ampel-ci.yml
+++ b/deploy/ampel-ci.yml
@@ -56,6 +56,11 @@ jobs:
               [ -n "$pkg" ] || continue
               d=$(dirname "$pkg")
               echo "-- $d"
+              if [ ! -f "$d/package-lock.json" ]; then
+                echo "❌ $d: kein package-lock.json — Build nicht reproduzierbar."
+                echo "   Fix: dort 'npm install --package-lock-only' ausführen und committen."
+                rot=1; continue
+              fi
               (cd "$d" && npm ci --no-audit --no-fund) || { rot=1; continue; }
               if grep -q '"build"' "$pkg"; then (cd "$d" && npm run build) || rot=1; fi
               if grep -q '"test"' "$pkg"; then (cd "$d" && npm test --silent) || rot=1; fi