diff --git a/.github/workflows/go-pr-analysis.yml b/.github/workflows/go-pr-analysis.yml
index 3e58649b..1b73f131 100644
--- a/.github/workflows/go-pr-analysis.yml
+++ b/.github/workflows/go-pr-analysis.yml
@@ -921,7 +921,11 @@ jobs:
   custom-checks:
     name: Custom Checks (${{ matrix.app.name }})
     needs: detect-changes
-    if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_custom_checks && inputs.custom_checks != ''
+    # Deliberately NOT also gated on `custom_checks != ''`. A caller that enables
+    # the gate but leaves the list empty is misconfigured, and skipping the job
+    # silently would report coverage that never happened — the run step warns
+    # instead.
+    if: needs.detect-changes.outputs.has_changes == 'true' && inputs.enable_custom_checks
     runs-on: ${{ vars.GENERAL_RUNNERS || inputs.runner_type }}
     # This is the only job that runs caller-supplied commands, so it is the one
     # place an unbounded hang is plausible. Caps the 6h GitHub default while
@@ -984,6 +988,10 @@ jobs:
         env:
           CUSTOM_CHECKS: ${{ inputs.custom_checks }}
         run: |
+          if [ -z "${CUSTOM_CHECKS//[[:space:]]/}" ]; then
+            echo "::warning::enable_custom_checks is true but custom_checks is empty — no checks ran"
+            exit 0
+          fi
           set +e
           failures=0
           while IFS= read -r target; do
diff --git a/.github/workflows/go-pr-validation.yml b/.github/workflows/go-pr-validation.yml
index 9cb38b55..3538889c 100644
--- a/.github/workflows/go-pr-validation.yml
+++ b/.github/workflows/go-pr-validation.yml
@@ -276,8 +276,12 @@ jobs:
       fail_on_coverage_threshold: ${{ inputs.fail_on_coverage_threshold }}
       go_private_modules: ${{ inputs.go_private_modules }}
       enable_integration_tests: ${{ inputs.enable_integration_tests }}
-      # Empty falls through to go-pr-analysis's own default (`make test-integration`),
-      # so an unset caller keeps the previous behaviour.
+      # Intentional duplicate of go-pr-analysis's own default — KEEP IN SYNC.
+      # A reusable-workflow default applies only when the input is omitted, and a
+      # `with:` mapping cannot conditionally omit a key: passing the empty string
+      # through would reach go-pr-analysis as '' and produce an empty `run:` in its
+      # integration-tests job, which is a workflow validation error. So the literal
+      # has to be repeated here rather than deferred to.
       integration_test_command: ${{ inputs.integration_test_command || 'make test-integration' }}
       enable_test_determinism: ${{ inputs.enable_test_determinism }}
       test_determinism_runs: ${{ inputs.test_determinism_runs }}