diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ef081b..6eed391 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -84,9 +84,11 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      - name: Run tests
+      - name: Run tests (race detector)
+        env:
+          CGO_ENABLED: "1"
         run: |
-          go test ./...
+          make test-race
 
       - name: Run embedded-library tests
         run: |
diff --git a/Makefile b/Makefile
index 08a7959..4bc20f9 100644
--- a/Makefile
+++ b/Makefile
@@ -22,6 +22,12 @@ install-tools:
 test:
 	go test ./...
 
+# test-race runs the full suite under the race detector. CI gates on this
+# target so data races in production code fail the build (PIPE-1223). Requires
+# a C toolchain (the race detector needs cgo).
+test-race:
+	go test -race ./...
+
 lint:
 	go tool revive -config .revive.toml -formatter friendly ./...