diff --git a/.gitattributes b/.gitattributes
index 4aa168f..b0d8dc2 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -93,3 +93,16 @@ Procfile text filter=spabs
 *.md text filter=spabs
 LICENSE text filter=spabs
 AUTHORS text filter=spabs
+
+# Not part of the installed package: Composer's dist downloads and
+# `git archive` leave these out.
+/.github export-ignore
+/tests export-ignore
+/phpstan.neon export-ignore
+/phpunit.xml export-ignore
+/composer.lock export-ignore
+/.gitattributes export-ignore
+/.gitconfig export-ignore
+/.gitignore export-ignore
+/CODE_OF_CONDUCT.md export-ignore
+/CONTRIBUTING.md export-ignore
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 114f487..d878876 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,6 +38,16 @@ jobs:
       - name: Show extensions
         run: php -m | grep -iE '^(curl|json|iconv)$' || true
 
+      - name: Check package contents
+        # what Composer installs is `git archive`; anything else is export-ignore'd
+        run: |
+          extra=$(git archive HEAD | tar -t | grep -vE '^(LICENSE|README\.md|composer\.json|owa-autoloader\.php|src/.*)$' || true)
+          if [ -n "$extra" ]; then
+            echo "Not export-ignore'd in .gitattributes:"
+            echo "$extra"
+            exit 1
+          fi
+
       - name: Install dependencies
         run: composer install --no-interaction --no-progress --prefer-dist
 
diff --git a/src/sdk.php b/src/sdk.php
index c71a878..7b296a1 100644
--- a/src/sdk.php
+++ b/src/sdk.php
@@ -18,7 +18,7 @@
  */
 class sdk {
 
-    const VERSION = '1.1.0';
+    const VERSION = '1.1.1';
 
     private array $config;
 
diff --git a/tests/fixtures/echo-server.php b/tests/fixtures/echo-server.php
index 0229d58..5d34b8f 100644
--- a/tests/fixtures/echo-server.php
+++ b/tests/fixtures/echo-server.php
@@ -3,6 +3,13 @@
 // Router for `php -S`: echoes the request back as JSON so transports can be
 // tested against a real socket.
 
+// Never answer under a real web server: it would echo visitors' cookies back.
+if ( PHP_SAPI !== 'cli-server' ) {
+
+    http_response_code( 404 );
+    return;
+}
+
 if ( ( $_SERVER['REQUEST_URI'] ?? '' ) === '/status/404' ) {
 
     http_response_code( 404 );