diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fae2e71..6c33ca2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,9 +38,12 @@ jobs:
         with:
           version: '0.16.9'
 
-  # Stage 1: install + app-factory smoke test. The Python matrix mirrors the
-  # supported range of the tracked Campus packages (campus-suite weekly and
-  # campus-api-python main both declare >=3.11,<3.14); keep the three in sync.
+  # Stage 1: install + app-factory smoke test. The Python matrix covers the
+  # security tier (3.11-3.13): officially supported per the campus Python
+  # support policy. campus-suite weekly and campus-api-python main declare
+  # >=3.11,<3.15 because they additionally CI-test bugfix-tier 3.14
+  # (allow-to-fail); admin supports the security tier only. Keep the
+  # security-tier part of the range in sync across the three.
   smoke:
     name: Smoke Test (${{ matrix.python-version }})
     needs: ruff
diff --git a/.gitignore b/.gitignore
index b37824c..4352597 100644
--- a/.gitignore
+++ b/.gitignore
@@ -83,9 +83,8 @@ profile_default/
 ipython_config.py
 
 # pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-.python-version
+#   .python-version IS tracked here: it pins the Railway/Nixpacks prod
+#   runtime to a security-tier release (campus Python support policy).
 
 # pipenv
 #   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..24ee5b1
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.13