diff --git a/.github/workflows/network-diff-capture.yml b/.github/workflows/network-diff-capture.yml
index 63aa64b26..905a9a3d9 100644
--- a/.github/workflows/network-diff-capture.yml
+++ b/.github/workflows/network-diff-capture.yml
@@ -43,7 +43,7 @@ jobs:
             'magika>=0.6.0' \
             'zstandard>=0.20.0' \
             'websockets>=13.0' \
-            'onnxruntime>=1.16.0' \
+            'onnxruntime>=1.24' \
             'transformers>=4.30.0' \
             'watchdog>=4.0.0' \
             'sqlite-vec>=0.1.6' \
@@ -107,7 +107,7 @@ jobs:
             'magika>=0.6.0' \
             'zstandard>=0.20.0' \
             'websockets>=13.0' \
-            'onnxruntime>=1.16.0' \
+            'onnxruntime>=1.24' \
             'transformers>=4.30.0' \
             'watchdog>=4.0.0' \
             'sqlite-vec>=0.1.6'
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index b192b5ac8..e14ef49d1 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -95,8 +95,49 @@ jobs:
         # at it — same contract `headroom/_ort.py` fulfills for Python
         # users via the pip `onnxruntime` package.
         run: |
-          pip install 'onnxruntime>=1.16.0'
-          echo "ORT_DYLIB_PATH=$(python -c "import onnxruntime, pathlib; p = pathlib.Path(onnxruntime.__file__).parent / 'capi'; print(next(iter(sorted(p.glob('libonnxruntime.so*')))))")" >> "$GITHUB_ENV"
+          # >= 1.24, not 1.16: `ort`'s ORT_API_VERSION resolves to 24 because
+          # `fastembed` enables its `api-24` feature.
+          pip install 'onnxruntime>=1.24'
+          # Pre-flight, not just a pin. `ort` deadlocks rather than errors on
+          # ANY failure inside `load_dylib_from_path` — a version mismatch and
+          # a library that cannot be resolved at all both re-enter the `Once`
+          # that `setup_api()` is initialising, and `std::sync::Once` blocks
+          # forever on re-entry. Either way the job burns its full 30-minute
+          # timeout at 0% CPU with nothing in the log. Assert both conditions
+          # here so a bad runner fails in seconds with a readable message.
+          python - <<'PY' >> "$GITHUB_ENV"
+          import pathlib, sys
+
+          def die(msg: str) -> None:
+              print(f"::error::{msg}", file=sys.stderr)
+              raise SystemExit(1)
+
+          try:
+              import onnxruntime
+          except Exception as exc:  # noqa: BLE001 - any import failure is fatal here
+              die(f"onnxruntime is not importable: {exc}")
+
+          version = onnxruntime.__version__
+          try:
+              major, minor = (int(part) for part in version.split(".")[:2])
+          except ValueError:
+              die(f"cannot parse onnxruntime version {version!r}")
+          if (major, minor) < (1, 24):
+              die(
+                  f"onnxruntime {version} is too old: ort requires >= 1.24 "
+                  "(ORT_API_VERSION=24, set by fastembed's api-24 feature). "
+                  "ort DEADLOCKS instead of erroring below this, so the tests "
+                  "would hang rather than fail."
+              )
+
+          capi = pathlib.Path(onnxruntime.__file__).parent / "capi"
+          libs = sorted(capi.glob("libonnxruntime.so*")) or sorted(capi.glob("libonnxruntime*.dylib"))
+          if not libs:
+              die(f"no libonnxruntime shared library under {capi}")
+
+          print(f"ORT_DYLIB_PATH={libs[0]}")
+          print(f"onnxruntime {version} -> {libs[0]}", file=sys.stderr)
+          PY
       - name: cargo fmt --check
         run: cargo fmt --all -- --check
       - name: cargo clippy