diff --git a/scripts/verify-dep-lockstep.mjs b/scripts/verify-dep-lockstep.mjs
index 22ebb9ad..55553375 100644
--- a/scripts/verify-dep-lockstep.mjs
+++ b/scripts/verify-dep-lockstep.mjs
@@ -249,7 +249,14 @@ export function topLevelLockVersions(lock) {
  * cannot read it, so it must say so rather than skip the install.
  */
 export function hasReadableLockShape(lock) {
-  const packages = lock?.packages;
+  // The declared version is checked, not just inferred from the presence of a
+  // `packages` key: this function and the diagnostic it drives both promise
+  // "lockfileVersion 2+", so a file claiming v1 while carrying a `packages`
+  // table must be rejected rather than half-trusted (Copilot, #1962).
+  const version = lock?.lockfileVersion;
+  if (typeof version !== "number" || !Number.isFinite(version) || version < 2)
+    return false;
+  const packages = lock.packages;
   if (typeof packages !== "object" || packages === null) return false;
   return Object.prototype.hasOwnProperty.call(packages, "");
 }
diff --git a/scripts/verify-dep-lockstep.test.mjs b/scripts/verify-dep-lockstep.test.mjs
index a00ce642..55ca3b6f 100644
--- a/scripts/verify-dep-lockstep.test.mjs
+++ b/scripts/verify-dep-lockstep.test.mjs
@@ -302,11 +302,20 @@ test("hasReadableLockShape: only a v2+ packages table with a root entry (Copilot
     undefined,
     null,
     {},
-    { packages: null },
-    { packages: [] }, // an array has no `""` key
-    { packages: {} }, // no root entry
-    { packages: { "node_modules/zod": { version: "4.4.3" } } },
+    { lockfileVersion: 3, packages: null },
+    { lockfileVersion: 3, packages: [] }, // an array has no `""` key
+    { lockfileVersion: 3, packages: {} }, // no root entry
+    {
+      lockfileVersion: 3,
+      packages: { "node_modules/zod": { version: "4.4.3" } },
+    },
     { lockfileVersion: 1, dependencies: { zod: { version: "4.4.3" } } },
+    // A declared v1 carrying a `packages` table: the version is checked, not
+    // inferred from the key's presence, so this is rejected rather than
+    // half-trusted into an empty (fail-open) version map.
+    { lockfileVersion: 1, packages: { "": {} } },
+    { packages: { "": {} } }, // no declared version at all
+    { lockfileVersion: "3", packages: { "": {} } }, // not a number
   ];
   for (const lock of rejected)
     assert.equal(hasReadableLockShape(lock), false, JSON.stringify(lock));