diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index eb38669..bd193e8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,3 +17,10 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd9f550..77f4762 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          submodules: recursive
 
       - name: Set up Python 3.11
         uses: actions/setup-python@v7
@@ -29,6 +31,13 @@ jobs:
       - name: Install demo dependencies
         run: pip install -r requirements.txt
 
+      - name: Validate web console examples submodule
+        run: |
+          git submodule status --recursive
+          test -f web-console/vendor/examples/financial-services/catalog.json
+          test -f web-console/vendor/examples/financial-services/policy/allow.cedar
+          python -m py_compile web-console/run.py web-console/webserver.py web-console/policy_variants.py
+
       # Run in order: demo-01 produces workspace/trace-claim.json, which
       # demo-02 and demo-03 consume.
       - name: Demo 1 - cMCP in action