diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 4cac708..aa635ed 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -98,8 +98,15 @@ jobs:
           output-file: merged.sarif
       - name: Check merged SARIF file
         run: |
+          # Structure: version, schema, 2 runs
           run_count=$(jq '.runs | length' merged.sarif)
           [ "$run_count" -eq 2 ] || { echo "FAIL: expected 2 runs, got $run_count"; exit 1; }
           echo "Merged SARIF has $run_count runs."
           jq -e '.version and .["$schema"] and (.runs | length > 0)' merged.sarif >/dev/null || { echo "FAIL: invalid SARIF structure"; exit 1; }
+
+          # Content: results from test_sarif1.json (ruleId KSV-0014) and test_sarif2.json (ruleId CVE-2026-26019) must be present
+          rule_ids=$(jq -r '[.runs[].results[].ruleId] | unique[]' merged.sarif)
+          echo "$rule_ids" | grep -q 'KSV-0014' || { echo "FAIL: merged file missing result from test_sarif1.json (ruleId KSV-0014)"; exit 1; }
+          echo "$rule_ids" | grep -q 'CVE-2026-26019' || { echo "FAIL: merged file missing result from test_sarif2.json (ruleId CVE-2026-26019)"; exit 1; }
+          echo "Merged results contain ruleIds from both input files."
           echo "All checks passed."