diff --git a/.github/sig-floor.json b/.github/sig-floor.json
new file mode 100644
index 000000000..deea31de2
--- /dev/null
+++ b/.github/sig-floor.json
@@ -0,0 +1,39 @@
+{
+ "about": "SIG 4-star checks this app meets and must keep meeting (gate 123, sig-floor). Generated by check_sig_floor.py write; raised by the workflow, never lowered by hand.",
+ "schema": 1,
+ "profile": "four-star",
+ "tools": {
+  "lizard": "1.24.3"
+ },
+ "measured_at": "1c3dff98d36e23cc2e3b6c30b7dbe2d1af5aff84",
+ "checks": [
+  "javascript duplication",
+  "javascript unit_interfacing >2",
+  "javascript unit_interfacing >4",
+  "javascript unit_interfacing >6",
+  "php unit_interfacing >6",
+  "python component_independence",
+  "python duplication",
+  "python module_coupling >10",
+  "python module_coupling >20",
+  "python module_coupling >50",
+  "python unit_complexity >10",
+  "python unit_complexity >25",
+  "python unit_complexity >5",
+  "python unit_interfacing >2",
+  "python unit_interfacing >4",
+  "python unit_interfacing >6",
+  "python unit_size >15",
+  "python unit_size >30",
+  "python unit_size >60",
+  "vue unit_complexity >10",
+  "vue unit_complexity >25",
+  "vue unit_complexity >5",
+  "vue unit_interfacing >2",
+  "vue unit_interfacing >4",
+  "vue unit_interfacing >6",
+  "vue unit_size >15",
+  "vue unit_size >30",
+  "vue unit_size >60"
+ ]
+}
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 81c61d62d..ac80657ca 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -265,6 +265,11 @@ jobs:
       # here — the job reported `skipped`, which the Quality Report renders
       # identically to a pass.
       enable-hydra-gates: true
+      # Gate 122 (SIG unit ratchet) blocks: a unit this change adds or makes
+      # worse must stay at NLOC 60, McCabe 10 and at most 4 parameters, and a
+      # new duplicated fragment of 6+ lines fails. Units the change does not
+      # touch, or touches without making worse, are inherited and do not count.
+      hydra-gates-sig-blocking: true
       # No `hydra-gates-ref` here on purpose. The shared workflow defaults it
       # to @main, and this workflow is itself consumed at @main, so the two
       # sides move together and a gate fix reaches this repo without a commit