diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 8cc0b57c..d46819f1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -47,4 +47,4 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests check-federation-off-deps check-nats-isolated check-no-second-web-stack
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f066748..dca2f5da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests check-federation-off-deps check-nats-isolated check-no-second-web-stack
 
   docker:
     name: Build & Push Docker Image
diff --git a/Makefile b/Makefile
index 3479d34c..2f32fc76 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := check
 
-check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests check-federation-off-deps check-nats-isolated check-no-second-web-stack
 	@echo "✅ All checks passed"
 
 check-appcontext:
@@ -103,6 +103,40 @@ check-dockerfile-manifests:
 	fi; \
 	echo "✅ Dockerfile copies a manifest for every workspace member"
 
+CARGO_TREE_NAMES := cargo tree -p server -p worker -e normal --prefix none
+
+check-federation-off-deps:
+	@hits=$$($(CARGO_TREE_NAMES) --no-default-features | grep -E '^(k-ap|activitypub_federation|activitypub|sqlite-federation) ' | sort -u); \
+	if [ -n "$$hits" ]; then \
+	    echo "❌ federation-only crates in the --no-default-features server/worker tree:"; \
+	    echo "$$hits"; \
+	    exit 1; \
+	fi; \
+	echo "✅ federation-off tree has no k-ap, activitypub_federation, activitypub, or sqlite-federation"
+
+check-nats-isolated:
+	@if $(CARGO_TREE_NAMES) | grep -qE '^(async-nats|nats) '; then \
+	    echo "❌ nats crates in the default server/worker tree:"; \
+	    $(CARGO_TREE_NAMES) | grep -E '^(async-nats|nats) ' | sort -u; \
+	    exit 1; \
+	fi; \
+	if ! $(CARGO_TREE_NAMES) --features nats | grep -qE '^async-nats '; then \
+	    echo "❌ async-nats missing from the --features nats server/worker tree — feature is not wired"; \
+	    exit 1; \
+	fi; \
+	echo "✅ async-nats only appears with --features nats"
+
+check-no-second-web-stack:
+	@for f in "" "--features nats"; do \
+	    hits=$$($(CARGO_TREE_NAMES) $$f | grep -E '^(actix|aws-lc)' | sort -u); \
+	    if [ -n "$$hits" ]; then \
+	        echo "❌ actix/aws-lc crates in the server/worker tree ($${f:-default}):"; \
+	        echo "$$hits"; \
+	        exit 1; \
+	    fi; \
+	done; \
+	echo "✅ no actix-* or aws-lc-* in the default or nats server/worker tree"
+
 fmt:
 	cargo fmt
 
@@ -145,4 +179,4 @@ dev-spa:
 spa-dev:
 	@npm --prefix spa run dev
 
-.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
+.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests check-federation-off-deps check-nats-isolated check-no-second-web-stack