diff --git a/.gitattributes b/.gitattributes
index 547d1e5..da11e23 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,4 @@
+.gitattributes text eol=lf
 /prometheus/README.md text eol=lf
 /prometheus/ATTRIBUTION.md text eol=lf
 /prometheus/profiles/**/manifest.yaml text eol=lf
diff --git a/.github/workflows/prometheus-evidence.yml b/.github/workflows/prometheus-evidence.yml
index 36b52e9..c378589 100644
--- a/.github/workflows/prometheus-evidence.yml
+++ b/.github/workflows/prometheus-evidence.yml
@@ -2,14 +2,15 @@
 name: Prometheus Evidence Immutability
 
 on:
-  pull_request:
-    paths:
-      - 'prometheus/profiles/**'
-      - '.github/workflows/prometheus-evidence.yml'
+  pull_request: null
 
 permissions:
   contents: read
 
+concurrency:
+  group: prometheus-evidence-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
 jobs:
   immutable-paths:
     runs-on: ubuntu-latest
@@ -18,13 +19,42 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          sparse-checkout: |
+            .gitattributes
+            .github/workflows/prometheus-evidence.yml
+            prometheus
+          sparse-checkout-cone-mode: false
+
+      - name: Verify LF storage contract
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          attributes_file=$(mktemp)
+          trap 'rm -f "${attributes_file}"' EXIT
+          {
+            printf '%s\0' .gitattributes
+            git ls-files -z -- prometheus
+          } | git check-attr --stdin -z eol > "${attributes_file}"
+          mapfile -d '' -t attributes < "${attributes_file}"
+          test "${#attributes[@]}" -gt 0
+          test "$((${#attributes[@]} % 3))" -eq 0
+          for ((index = 0; index < ${#attributes[@]}; index += 3)); do
+            path=${attributes[index]}
+            attribute=${attributes[index + 1]}
+            value=${attributes[index + 2]}
+            if [[ "${attribute}" != eol || "${value}" != lf ]]; then
+              echo "Prometheus evidence must check out with LF line endings: ${path}: ${attribute}: ${value}" >&2
+              exit 1
+            fi
+          done
 
       - name: Reject changes to existing evidence
         shell: bash
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
-          set -euo pipefail
+          set -euxo pipefail
 
           if git diff --quiet --diff-filter=MDRT "${BASE_SHA}"...HEAD -- prometheus/profiles; then
             :
diff --git a/prometheus/README.md b/prometheus/README.md
index 94dcb31..1c14af5 100644
--- a/prometheus/README.md
+++ b/prometheus/README.md
@@ -5,11 +5,11 @@ stock Prometheus profiles in `netdata/netdata`.
 
 ## Data boundary
 
-- `profiles/<profile>/fixtures/` contains sanitized, source-derived synthetic
+- `profiles/<profile-revision>/fixtures/` contains sanitized, source-derived synthetic
   Prometheus exposition.
-- `profiles/<profile>/SOURCE-INVENTORY.tsv` contains the generated
+- `profiles/<profile-revision>/SOURCE-INVENTORY.tsv` contains the generated
   source-family-to-profile reconciliation ledger.
-- `profiles/<profile>/manifest.yaml` records the size and SHA-256 digest of
+- `profiles/<profile-revision>/manifest.yaml` records the size and SHA-256 digest of
   every evidence file.
 
 These fixtures are structural unions assembled from public exporter source and