diff --git a/validate/deps.sh b/validate/deps.sh
index 91bd8db..d09bb4e 100755
--- a/validate/deps.sh
+++ b/validate/deps.sh
@@ -44,8 +44,13 @@ if [ -n "$has_python" ]; then
     printf "   source: %s (requirements file)\n" "$has_reqtxt"
     audit_cmd="pip-audit -r $has_reqtxt"
   else
-    printf "   source: %s (environment mode)\n" "$has_pyproject"
-    audit_cmd="pip-audit"
+    # pyproject.toml present but no uv.lock and no requirements.txt.
+    # Running bare `pip-audit` here would audit the gauntlet's own
+    # Python environment (pip-audit's bundled uv-tool venv), producing
+    # false positives. Skip cleanly instead of mutating the project
+    # with `uv lock` / `uv sync` as a side effect of validation.
+    printf "${YELLOW}!${NC} No uv.lock found — run 'uv sync' to enable deps audit, skipping for now\n"
+    exit 2
   fi
 
   # Run via eval so audit_cmd can carry shell metacharacters (e.g. the