diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 19a5389..2fbd2c7 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -29,3 +29,11 @@ jobs:
           echo "$HOME/.jolt" >> "$GITHUB_PATH"
       - name: Test
         run: JOLT_TEST_PG_URI=postgres://postgres:postgres@127.0.0.1:5432/jolt_test JOLT_PWD="$PWD" jolt -M:test
+
+      # clojure.jdbc's OWN suite, from its tree at the sha deps.edn pins. This
+      # library's job is to run the published clojure.jdbc unmodified, and only
+      # upstream's tests can say whether it still does — the suite here is ours
+      # and agrees with our own idea of the API. It ran for the first time in
+      # #15 and found five gaps.
+      - name: clojure.jdbc conformance
+        run: ./ci/clojure-jdbc-conformance.sh
diff --git a/ci/clojure-jdbc-conformance.sh b/ci/clojure-jdbc-conformance.sh
new file mode 100755
index 0000000..7c3ffbf
--- /dev/null
+++ b/ci/clojure-jdbc-conformance.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+# Run clojure.jdbc's own test suite against db.jdbc-shim.
+#
+# The tests come from upstream's tree at the sha deps.edn already pins, so this
+# gate and the library under test can never disagree about which clojure.jdbc is
+# meant. Vendoring the test files here would drift: they would keep passing
+# against whatever the shim had become.
+#
+# Upstream ships its tests outside :paths, so they cannot be reached by adding
+# an alias to db's own deps.edn. A throwaway project is assembled instead, with
+# db as a :local/root and the checkout's test/ directory on the source roots.
+set -eu
+
+db_root=$(cd "$(dirname "$0")/.." && pwd)
+work=${TMPDIR:-/tmp}/jdbc-conformance.$$
+trap 'rm -rf "$work"' EXIT
+mkdir -p "$work/checkout" "$work/project"
+
+# The coordinates come out of deps.edn rather than being repeated here: a bump
+# to the clojure.jdbc pin must move this gate with it, not leave it testing an
+# older tree that still passes.
+read_dep() {
+  jolt -e "(let [d (:deps (read-string (slurp \"$db_root/deps.edn\")))
+                 e (val (first (filter (fn [[k _]] (= (name k) \"clojure.jdbc\")) d)))]
+             (println ($1 e)))"
+}
+url=$(read_dep :git/url)
+sha=$(read_dep :git/sha)
+[ -n "$url" ] && [ -n "$sha" ] || { echo "could not read the clojure.jdbc pin from deps.edn" >&2; exit 1; }
+echo "clojure.jdbc conformance: $url @ $sha"
+
+# Fetch the one commit rather than cloning the history.
+cd "$work/checkout"
+git init -q .
+git remote add origin "$url"
+git fetch -q --depth 1 origin "$sha"
+git checkout -q FETCH_HEAD
+[ -d test ] || { echo "no test/ directory at $sha" >&2; exit 1; }
+
+cat > "$work/project/deps.edn" <<DEPS
+{:paths ["$db_root/conformance"]
+ :deps {jolt-lang/db {:local/root "$db_root"}}
+ :aliases {:test {:extra-paths ["$work/checkout/test"]
+                  :main-opts ["-m" "jdbc-conformance"]}}}
+DEPS
+
+cd "$work/project"
+exec jolt -M:test
diff --git a/conformance/jdbc_conformance.clj b/conformance/jdbc_conformance.clj
new file mode 100644
index 0000000..95d44fd
--- /dev/null
+++ b/conformance/jdbc_conformance.clj
@@ -0,0 +1,27 @@
+(ns jdbc-conformance
+  "Runs clojure.jdbc's OWN test suite against this library.
+
+  db.jdbc-shim stands in for java.sql so the published clojure.jdbc runs
+  unmodified. The only way to know it still does is to run the tests upstream
+  ships, from upstream's tree, at the sha deps.edn pins — not a copy of them
+  kept here, which drifts silently and then agrees with whatever we broke.
+
+  The namespaces are the sqlite-only set upstream nominates for this in its own
+  tests-jolt.edn. jdbc.postgres-test is excluded there because it needs a live
+  postgres and hikari-cp; db's own suite covers the postgres driver."
+  (:require [clojure.test :as t]
+            [db.jdbc]
+            [jdbc.core-test]
+            [jdbc.util-test]
+            [jdbc.impl-test]
+            [jdbc.meta-test]))
+
+(def ^:private namespaces
+  ['jdbc.core-test 'jdbc.util-test 'jdbc.impl-test 'jdbc.meta-test])
+
+(defn -main [& _]
+  (let [{:keys [fail error] :as r} (apply t/run-tests namespaces)]
+    (println "clojure.jdbc conformance:" (pr-str r))
+    (when (pos? (+ (or fail 0) (or error 0)))
+      (println "clojure.jdbc's own suite no longer passes against db.jdbc-shim.")
+      (System/exit 1))))