diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 9957e3d..31949ac 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -110,6 +110,13 @@ jobs:
           - label: 'devEngines onFail=error, range (#252)'
             manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":">=9.15.0","onFail":"error"}}}'
             version: '>=9.15.0'
+          - label: 'devEngines onFail=error + explicit version mismatch keeps strictness'
+            # Regression guard for the af8e203 scope fix: when the user passes an
+            # explicit `version:` input, the action must NOT export
+            # pnpm_config_pm_on_fail=download, so `onFail=error` still fires.
+            manifest: '{"devEngines":{"packageManager":{"name":"pnpm","version":"9.15.5","onFail":"error"}}}'
+            explicit_version: '10.33.0'
+            expect_pnpm_error: true
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -120,8 +127,11 @@ jobs:
 
       - name: Run the action
         uses: ./
+        with:
+          version: ${{ matrix.explicit_version }}
 
       - name: 'Test: pnpm reports the pinned version'
+        if: ${{ !matrix.expect_pnpm_error }}
         env:
           REQUIRED: ${{ matrix.version }}
         run: |
@@ -142,6 +152,19 @@ jobs:
           fi
         shell: bash
 
+      - name: 'Test: pnpm exits non-zero (onFail=error strictness preserved)'
+        if: ${{ matrix.expect_pnpm_error }}
+        run: |
+          set +e
+          out="$(pnpm --version 2>&1)"
+          rc=$?
+          echo "${out}"
+          if [ $rc -eq 0 ]; then
+            echo "Expected pnpm --version to fail (devEngines.onFail=error mismatch), but it exited 0"
+            exit 1
+          fi
+        shell: bash
+
   standalone:
     name: Standalone mode