diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a797fdd..de14352 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,7 +87,11 @@ jobs:
 
       - name: Install system dependencies (Linux only)
         if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev
+        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev nftables
+
+      - name: Validate fips.nft syntax (Linux only)
+        if: runner.os == 'Linux'
+        run: sudo nft -c -f packaging/common/fips.nft
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/testing/ci-local.sh b/testing/ci-local.sh
index 47d3b37..bbc6176 100755
--- a/testing/ci-local.sh
+++ b/testing/ci-local.sh
@@ -177,6 +177,20 @@ record() {
 run_build() {
     stage "Stage 1: Build"
 
+    info "sudo nft -c -f packaging/common/fips.nft (nftables ruleset syntax check)"
+    if command -v nft &>/dev/null; then
+        if sudo nft -c -f packaging/common/fips.nft 2>&1; then
+            record "nft-syntax" 0
+        else
+            record "nft-syntax" 1
+            return 1
+        fi
+    else
+        info "nftables not installed; install with 'apt install nftables' to validate fips.nft"
+        record "nft-syntax" 1
+        return 1
+    fi
+
     info "cargo build --release"
     if cargo build --release 2>&1; then
         record "build" 0