diff --git a/images/ci-tools/Dockerfile b/images/ci-tools/Dockerfile
index 40bc025..1c85116 100644
--- a/images/ci-tools/Dockerfile
+++ b/images/ci-tools/Dockerfile
@@ -63,6 +63,8 @@ RUN apt-get update \
     git \
     gnupg \
     xmlstarlet \
+    zip \
+    unzip \
   && apt-get clean \
   && rm -rf /var/lib/apt/lists/*
 
diff --git a/images/ci-tools/README.md b/images/ci-tools/README.md
index 3429333..76dc4d5 100644
--- a/images/ci-tools/README.md
+++ b/images/ci-tools/README.md
@@ -26,9 +26,11 @@ CI pipelines. Published to GHCR at `ghcr.io/knight-owl-dev/ci-tools`.
 | [shellcheck](https://github.com/koalaman/shellcheck) | Shell script linting |
 | [shfmt](https://github.com/mvdan/sh) | Shell script formatting |
 | [stylelint](https://github.com/stylelint/stylelint) | CSS linting |
+| [unzip](https://infozip.sourceforge.net) | Archive extraction for archive-format test fixtures (ODT/DOCX/EPUB) |
 | validate-action-pins | GitHub Actions SHA pin verification |
 | [xmlstarlet](https://xmlstar.sourceforge.net) | XML querying and editing |
 | [yq](https://github.com/mikefarah/yq) | YAML/JSON/XML processing |
+| [zip](https://infozip.sourceforge.net) | Archive assembly for archive-format test fixtures (ODT/DOCX/EPUB) |
 
 Pinned versions and checksums are tracked in
 [`versions.lock`](versions.lock).
diff --git a/scripts/ci-tools/verify.sh b/scripts/ci-tools/verify.sh
index bf5198f..3fd2efa 100755
--- a/scripts/ci-tools/verify.sh
+++ b/scripts/ci-tools/verify.sh
@@ -58,6 +58,8 @@ check "gpg" "" gpg --version
 check "make" "" make --version
 check "parallel" "" parallel --version
 check "xmlstarlet" "" xmlstarlet --version
+check "zip" "" zip -v
+check "unzip" "" unzip -v
 check "locale-en-us" "" bash -c "locale -a | grep -q en_US.utf8"
 check "lc-all-default" "C" printenv LC_ALL
 verify_exit