diff --git a/.github/workflows/stackpacks-ci.yml b/.github/workflows/stackpacks-ci.yml
index ab4a90a..b405037 100644
--- a/.github/workflows/stackpacks-ci.yml
+++ b/.github/workflows/stackpacks-ci.yml
@@ -66,6 +66,8 @@ jobs:
     if: ${{ needs.discover-stackpacks.outputs.has_stackpacks == 'true' }}
     name: validate (${{ matrix.stackpack }})
     runs-on: ubuntu-24.04
+    env:
+      VALIDATOR_IMAGE: quay.io/stackstate/stackstate-server:7.0.0-snapshot.20261012082244-master-05004e2-2.5@sha256:2b980e1e2948eff5892e5815ed0d4a17780b8312b1eb2831234fdf7cfacfab8c
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.discover-stackpacks.outputs.matrix) }}
@@ -78,15 +80,18 @@ jobs:
       - name: Validate ${{ matrix.stackpack }}
         env:
           STACKPACK: ${{ matrix.stackpack }}
-          # Pinned snapshot of stackstate-server providing /opt/docker/bin/stack-pack-validator.
-          # Bumped manually when validating a newer stackstate-server release.
-          VALIDATOR_IMAGE: quay.io/stackstate/stackstate-server:b7c3604-2.5
+        run: bash scripts/ci/validate_stackpack.sh "stackpacks/${STACKPACK}"
+
+      - name: Verify validator rejects an invalid mapping expression
         run: |
-          docker run --rm \
-            -v "${PWD}:/workspace" \
-            -w /workspace \
-            "${VALIDATOR_IMAGE}" \
-            /opt/docker/bin/stack-pack-validator -directory "/workspace/stackpacks/${STACKPACK}"
+          output=$(mktemp)
+          if bash scripts/ci/validate_stackpack.sh tests/fixtures/invalid-component-mapping >"${output}" 2>&1; then
+            cat "${output}"
+            echo "Validator accepted an invalid mapping" >&2
+            exit 1
+          fi
+          cat "${output}"
+          grep -q "undeclared.*undeclaredValidationControl" "${output}"
 
   package:
     name: package (${{ matrix.stackpack }})
@@ -200,7 +205,7 @@ jobs:
           github.event.repository.owner.login == 'StackVista')
       ) &&
       needs.discover-stackpacks.outputs.has_stackpacks == 'true' &&
-      (needs.package.result == 'success' || needs.package.result == 'skipped')
+      needs.package.result == 'success'
     runs-on: ubuntu-24.04
     permissions:
       contents: read
diff --git a/scripts/ci/validate_stackpack.sh b/scripts/ci/validate_stackpack.sh
new file mode 100755
index 0000000..579c09d
--- /dev/null
+++ b/scripts/ci/validate_stackpack.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+stackpack_dir=$(realpath "${1:?StackPack directory is required}")
+: "${VALIDATOR_IMAGE:?VALIDATOR_IMAGE must be set}"
+
+docker run --rm --network none \
+  --entrypoint /opt/docker/bin/stack-pack-validator \
+  -v "${stackpack_dir}:/stackpack:ro,z" \
+  "${VALIDATOR_IMAGE}" \
+  -directory /stackpack
diff --git a/tests/fixtures/invalid-component-mapping/resources/logo.svg b/tests/fixtures/invalid-component-mapping/resources/logo.svg
new file mode 100644
index 0000000..3b4bcab
--- /dev/null
+++ b/tests/fixtures/invalid-component-mapping/resources/logo.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1 1"><rect width="1" height="1"/></svg>
diff --git a/tests/fixtures/invalid-component-mapping/resources/overview.md b/tests/fixtures/invalid-component-mapping/resources/overview.md
new file mode 100644
index 0000000..ff4101c
--- /dev/null
+++ b/tests/fixtures/invalid-component-mapping/resources/overview.md
@@ -0,0 +1 @@
+This fixture must fail validation because its component mapping uses an undeclared CEL variable.
diff --git a/tests/fixtures/invalid-component-mapping/settings/mapping.sty b/tests/fixtures/invalid-component-mapping/settings/mapping.sty
new file mode 100644
index 0000000..164bca8
--- /dev/null
+++ b/tests/fixtures/invalid-component-mapping/settings/mapping.sty
@@ -0,0 +1,25 @@
+nodes:
+  - _type: OtelComponentMapping
+    name: Invalid component mapping
+    identifier: urn:stackpack:validator-test:otel-component-mapping:invalid
+    input:
+      signal: [LOGS]
+      resource:
+        scope:
+          log:
+            action: "'CREATE'"
+            condition: "true"
+    vars: []
+    output:
+      identifier: "'urn:validator-test:component'"
+      name: "undeclaredValidationControl"
+      typeName: "'vm'"
+      required:
+        configuration: "{}"
+        tags: []
+      optional:
+        status: "{}"
+        tags: []
+    rank:
+      specificity: 10.0
+    expireAfter: 900000
diff --git a/tests/fixtures/invalid-component-mapping/stackpack.yaml b/tests/fixtures/invalid-component-mapping/stackpack.yaml
new file mode 100644
index 0000000..88add3a
--- /dev/null
+++ b/tests/fixtures/invalid-component-mapping/stackpack.yaml
@@ -0,0 +1,11 @@
+name: invalid-component-mapping
+version: "0.0.1"
+schemaVersion: "2.0"
+displayName: Invalid component mapping
+logoUrl: !resource "logo.svg"
+overviewUrl: !resource "overview.md"
+detailedOverviewUrl: !resource "overview.md"
+categories: []
+configurationUrls: {}
+provision:
+  companionStackPacks: []