diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index 1990690..cf53b5c 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -52,6 +52,10 @@ on:
         type: string
         default: "auto"
         description: "Version resolution for from-head: auto | patch | minor (forced)."
+      submodules:
+        type: string
+        default: ""
+        description: "Space-separated submodule paths to init after checkout (e.g. 'schemas'). Empty (default) inits nothing. The submodule must be reachable by the job token -- public, or a token with cross-repo read access."
     secrets:
       JFROG_TOKEN:
         required: false
@@ -232,6 +236,12 @@ jobs:
       - name: Install dependencies
         run: uv sync --frozen --all-extras
 
+      - name: Init submodules
+        if: ${{ inputs.submodules != '' }}
+        env:
+          SUBMODULES: ${{ inputs.submodules }}
+        run: git submodule update --init --depth 1 $SUBMODULES
+
       - name: Run tests
         run: ${{ env.HYPERCI_INSTALL }} run test
 
diff --git a/docs/LESSONS.md b/docs/LESSONS.md
index a8482c7..a52897e 100644
--- a/docs/LESSONS.md
+++ b/docs/LESSONS.md
@@ -299,9 +299,13 @@ build to ensure fresh artifacts, also via `hyperi-ci run build`.
 - Detection: directory-based > marker-based > conftest-based
 - Coverage: separate `.coverage.<tier>` files, combine at end
 - No test directory: exit 0 (graceful skip)
-- Private submodules (e.g. `dfe-schemas`): mark dependent tests with
-  `@pytest.mark.skipif(not schemas_dir.exists(), reason="submodule not checked out")`
-  rather than trying to check out private submodules in CI (GITHUB_TOKEN can't)
+- Submodule-dependent tests:
+  - Public submodule: set the `submodules` input on the reusable workflow
+    (e.g. `submodules: schemas`) so CI checks it out and the tests run.
+  - Private submodule (e.g. `dfe-schemas` while private): GITHUB_TOKEN can't
+    clone it, so mark dependent tests with
+    `@pytest.mark.skipif(not schemas_dir.exists(), reason="submodule not checked out")`
+    rather than checking it out in CI (or wire a cross-repo token).
 
 ### Publishing