diff --git a/ci/ab-server.lock.json b/ci/ab-server.lock.json
new file mode 100644
index 0000000..b78c589
--- /dev/null
+++ b/ci/ab-server.lock.json
@@ -0,0 +1,20 @@
+{
+  "_comment": "Pinned libplctag release used by tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerFixture. ab_server.exe ships inside the *_tools.zip asset on every GitHub release. See docs/v2/test-data-sources.md §2.CI for the GitHub Actions step that consumes this file.",
+  "repo": "libplctag/libplctag",
+  "tag": "v2.6.16",
+  "published": "2026-03-29",
+  "assets": {
+    "windows-x64": {
+      "file": "libplctag_2.6.16_windows_x64_tools.zip",
+      "sha256": "9b78a3dee73d9cd28ca348c090f453dbe3ad9d07ad6bf42865a9dc3a79bc2232"
+    },
+    "windows-x86": {
+      "file": "libplctag_2.6.16_windows_x86_tools.zip",
+      "sha256": "fdfefd58b266c5da9a1ded1a430985e609289c9e67be2544da7513b668761edf"
+    },
+    "windows-arm64": {
+      "file": "libplctag_2.6.16_windows_arm64_tools.zip",
+      "sha256": "d747728e4c4958bb63b4ac23e1c820c4452e4778dfd7d58f8a0aecd5402d4944"
+    }
+  }
+}
diff --git a/docs/v2/test-data-sources.md b/docs/v2/test-data-sources.md
index af8a1ff..1f2fd1c 100644
--- a/docs/v2/test-data-sources.md
+++ b/docs/v2/test-data-sources.md
@@ -196,22 +196,30 @@ The integration harness at `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTest
 - **`AbServerFixture(AbServerProfile)`** — starts the simulator with the CLI args composed from the profile's `--plc` family + seed-tag set. One fixture instance per family, one simulator process per test case (smoke tier). For larger suites that can share a simulator across several reads/writes, use a `IClassFixture<AbServerFixture>` wrapper per family.
 - **`KnownProfiles.{ControlLogix, CompactLogix, Micro800, GuardLogix}`** — the four per-family profiles. Drives the simulator's `--plc` mode + the preseed `--tag name:type[:size]` set. Micro800 + GuardLogix fall back to `controllogix` under the hood because ab_server has no dedicated mode for them — the driver-side family profile still enforces the narrower connection shape / safety classification separately.
 
-**CI step (intended — fleet-ops to wire):**
+**Pinned version** (recorded in `ci/ab-server.lock.json` so drift is one-file visible):
+
+- `libplctag` **v2.6.16** (published 2026-03-29) — `ab_server.exe` ships inside the `_tools.zip` asset alongside `plctag.dll` + two `list_tags_*` helpers.
+- Windows x64: `libplctag_2.6.16_windows_x64_tools.zip` — SHA256 `9b78a3dee73d9cd28ca348c090f453dbe3ad9d07ad6bf42865a9dc3a79bc2232`
+- Windows x86: `libplctag_2.6.16_windows_x86_tools.zip` — SHA256 `fdfefd58b266c5da9a1ded1a430985e609289c9e67be2544da7513b668761edf`
+- Windows ARM64: `libplctag_2.6.16_windows_arm64_tools.zip` — SHA256 `d747728e4c4958bb63b4ac23e1c820c4452e4778dfd7d58f8a0aecd5402d4944`
+
+**CI step:**
 
 ```yaml
 # GitHub Actions step placed before `dotnet test`:
-- name: Fetch ab_server
+- name: Fetch ab_server (libplctag v2.6.16)
   shell: pwsh
   run: |
-    $ver = '<pinned libplctag release tag>'
-    $url = "https://github.com/libplctag/libplctag/releases/download/$ver/ab_server-windows-x64.zip"
-    Invoke-WebRequest $url -OutFile $env:RUNNER_TEMP/ab_server.zip
-    # SHA256 check against a pinned value recorded in this repo's CI lockfile — drift = fail closed
-    $expected = '<pinned sha256>'
-    $actual = (Get-FileHash -Algorithm SHA256 $env:RUNNER_TEMP/ab_server.zip).Hash
-    if ($expected -ne $actual) { throw "ab_server hash mismatch" }
-    Expand-Archive $env:RUNNER_TEMP/ab_server.zip -DestinationPath $env:RUNNER_TEMP/ab_server
-    echo "$env:RUNNER_TEMP/ab_server" >> $env:GITHUB_PATH
+    $pin = Get-Content ci/ab-server.lock.json | ConvertFrom-Json
+    $asset = $pin.assets.'windows-x64'       # swap to windows-x86 / windows-arm64 on non-x64 runners
+    $url = "https://github.com/libplctag/libplctag/releases/download/$($pin.tag)/$($asset.file)"
+    $zip = Join-Path $env:RUNNER_TEMP 'libplctag-tools.zip'
+    Invoke-WebRequest $url -OutFile $zip
+    $actual = (Get-FileHash -Algorithm SHA256 $zip).Hash.ToLower()
+    if ($actual -ne $asset.sha256) { throw "libplctag tools SHA256 mismatch: expected $($asset.sha256), got $actual" }
+    $dest = Join-Path $env:RUNNER_TEMP 'libplctag-tools'
+    Expand-Archive $zip -DestinationPath $dest
+    Add-Content $env:GITHUB_PATH $dest
 ```
 
 The fixture's `LocateBinary()` picks the binary up off PATH so the C# harness doesn't own the download — CI YAML is the right place for version pinning + hash verification. Developer workstations install the binary once from source (`cmake + make ab_server` under a libplctag clone) and the same fixture works identically.