diff --git a/docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md b/docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md
index aed0a23..8fd749e 100644
--- a/docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md
+++ b/docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md
@@ -43,6 +43,16 @@ and related CI hardening.
   - `agents/rap-node-agent`
   - `backend`
 
+## One-Shot Guard Script
+
+- `scripts/smoke/run-vpnruntime-ci-guards.ps1`
+
+Example:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1
+```
+
 ## Transfer/Recovery Artifacts
 
 Local export files are available in ignored path:
@@ -54,4 +64,3 @@ Local export files are available in ignored path:
 See:
 
 - `docs/operations/VPNRUNTIME_CI_FIXES_TRANSFER_2026-05-12.md`
-
diff --git a/scripts/smoke/run-vpnruntime-ci-guards.ps1 b/scripts/smoke/run-vpnruntime-ci-guards.ps1
new file mode 100644
index 0000000..c91a81c
--- /dev/null
+++ b/scripts/smoke/run-vpnruntime-ci-guards.ps1
@@ -0,0 +1,56 @@
+param(
+    [int]$AntiFlakeCount = 20,
+    [int]$TargetedCount = 50,
+    [string]$TargetedTimeout = "60s",
+    [switch]$SkipRace
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..\..")
+$agentDir = Join-Path $repoRoot "agents\rap-node-agent"
+
+function Invoke-Go {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string[]]$Args
+    )
+    & go @Args
+    if ($LASTEXITCODE -ne 0) {
+        throw "go $($Args -join ' ') failed with exit code $LASTEXITCODE"
+    }
+}
+
+Write-Host "[vpnruntime] repo root: $repoRoot"
+Write-Host "[vpnruntime] agent dir: $agentDir"
+
+Push-Location $agentDir
+try {
+    Write-Host "[vpnruntime] go test ./..."
+    Invoke-Go -Args @("test", "./...")
+
+    Write-Host "[vpnruntime] go test ./internal/vpnruntime -count=$AntiFlakeCount"
+    Invoke-Go -Args @("test", "./internal/vpnruntime", "-count=$AntiFlakeCount")
+
+    Write-Host "[vpnruntime] targeted anti-flake"
+    Invoke-Go -Args @(
+        "test",
+        "./internal/vpnruntime",
+        "-run", "TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel",
+        "-count=$TargetedCount",
+        "-timeout=$TargetedTimeout"
+    )
+
+    if (-not $SkipRace) {
+        Write-Host "[vpnruntime] race check"
+        Invoke-Go -Args @("test", "-race", "./internal/vpnruntime")
+    } else {
+        Write-Host "[vpnruntime] race check skipped"
+    }
+
+    Write-Host "[vpnruntime] all guards passed"
+}
+finally {
+    Pop-Location
+}