diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9faae6e0..75f6c9d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,13 @@ jobs:
       # kit image build's `uv sync --locked`.
       run: uv lock --check
 
+    - name: Verify the echo-agent starter lock is in sync with its pyproject
+      # The starter ships a committed uv.lock that the kit launcher installs
+      # verbatim (`uv sync --locked`), so a lock that no longer satisfies the
+      # starter's constraints (e.g. a band-sdk floor bump without a relock)
+      # would break every fresh kit workspace.
+      run: uv lock --check --directory docker/band_python_kit/echo-agent
+
     - name: Install dependencies
       run: uv sync --extra dev
 
diff --git a/docker/band_python_kit/echo-agent/pyproject.toml b/docker/band_python_kit/echo-agent/pyproject.toml
index a0a24e70..fadada28 100644
--- a/docker/band_python_kit/echo-agent/pyproject.toml
+++ b/docker/band_python_kit/echo-agent/pyproject.toml
@@ -3,4 +3,8 @@ name = "band-kit-example"
 version = "0.1.0"
 description = "Example customer workspace for the Band Python Sandbox kit."
 requires-python = ">=3.11"
+# band-sdk floor: 1.4.0 is the first release whose WebSocket auth sends the
+# x-api-key handshake header, which proxy-managed credential custody (the
+# kit's default tier) requires — older SDKs only put the key in the URL query,
+# which the sandbox proxy never rewrites, so the agent cannot connect.
 dependencies = ["band-sdk>=1.4.2", "pydantic-settings>=2.0.0"]