diff --git a/.github/workflows/dependency-validation.yml b/.github/workflows/dependency-validation.yml
index c132aef..ddf7a9b 100644
--- a/.github/workflows/dependency-validation.yml
+++ b/.github/workflows/dependency-validation.yml
@@ -20,5 +20,12 @@ jobs:
     - run: python -m unittest discover -s .github/scripts
     - run: python -m compileall -q tools .github/scripts
     - run: python -m unittest discover -s tools/tests
+    - name: Verify pinned Mihomo and compile an MRS fixture
+      run: |
+        bash tools/download_mihomo.sh
+        ./mihomo -v
+        printf '+.example.com\n' > "$RUNNER_TEMP/mihomo-domain.txt"
+        ./mihomo convert-ruleset domain text "$RUNNER_TEMP/mihomo-domain.txt" "$RUNNER_TEMP/mihomo-domain.mrs"
+        test -s "$RUNNER_TEMP/mihomo-domain.mrs"
 
 
diff --git a/.github/workflows/gen-rulesets.yml b/.github/workflows/gen-rulesets.yml
index fbcc800..95df370 100644
--- a/.github/workflows/gen-rulesets.yml
+++ b/.github/workflows/gen-rulesets.yml
@@ -14,6 +14,7 @@ on:
     branches: [main]
     paths:
       - "tools/gen_rulesets.py"
+      - "tools/download_mihomo.sh"
       - "tools/rule_validation.py"
       - "tools/tests/**"
       - "tools/gen_diff.py"
@@ -55,12 +56,7 @@ jobs:
         shell: bash
         run: |
           set -euxo pipefail
-          VERSION="v1.19.32"
-          SHA256="ba3ce607747a07f948fc35780e108a4a7c7f552a38b9bd4d115f313ebcb89c20"
-          BASE="https://github.com/MetaCubeX/mihomo/releases/download/${VERSION}"
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -o mihomo.gz "${BASE}/mihomo-linux-amd64-compatible-${VERSION}.gz"
-          echo "${SHA256}  mihomo.gz" | sha256sum --check --strict
-          gzip -dc mihomo.gz > mihomo && chmod +x mihomo
+          bash tools/download_mihomo.sh
           echo "MIHOMO=./mihomo" >> "$GITHUB_ENV"
 
       - name: 生成规则集
diff --git a/tools/download_mihomo.sh b/tools/download_mihomo.sh
new file mode 100644
index 0000000..e23881c
--- /dev/null
+++ b/tools/download_mihomo.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION="v1.19.33"
+SHA256="386508bfb1c72c43b6a0eda73708ecdce82546581b0ebcb16366c53757c622b6"
+BASE="https://github.com/MetaCubeX/mihomo/releases/download/${VERSION}"
+curl --proto '=https' --tlsv1.2 -fsSL --retry 3 \
+  -o mihomo.gz "${BASE}/mihomo-linux-amd64-compatible-${VERSION}.gz"
+echo "${SHA256}  mihomo.gz" | sha256sum --check --strict
+gzip -dc mihomo.gz > mihomo
+chmod +x mihomo
diff --git a/tools/tests/test_audit_regressions.py b/tools/tests/test_audit_regressions.py
index 3ef806f..40e4b46 100644
--- a/tools/tests/test_audit_regressions.py
+++ b/tools/tests/test_audit_regressions.py
@@ -57,7 +57,11 @@ def test_snapshot_rejects_mixed_revision_and_unsafe_names(self):
     def test_workflow_guards(self):
         gen = (ROOT / '.github/workflows/gen-rulesets.yml').read_text()
         self.assertNotIn('--jq --arg', gen)
-        self.assertIn('sha256sum --check --strict', gen)
+        downloader = (ROOT / 'tools/download_mihomo.sh').read_text()
+        self.assertIn('bash tools/download_mihomo.sh', gen)
+        validation = (ROOT / '.github/workflows/dependency-validation.yml').read_text()
+        self.assertIn('bash tools/download_mihomo.sh', validation)
+        self.assertIn('sha256sum --check --strict', downloader)
         self.assertIn('needs: gen', gen)
         self.assertIn('persist-credentials: false', gen)
         docs = (ROOT / '.github/workflows/docs-watch.yml').read_text()