diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c33f12..2ff345b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,19 @@ Tags follow `v{opencode_version}[letter]` — bare tag for the first build on a
 
 ## Unreleased
 
-_(no changes since v1.16.2)_
+### Fixed: smoke-test pi-extensions readiness race (test-only, no image change)
+
+`scripts/smoke-test.sh`'s entrypoint-deploy wait loop gated only on
+`keybindings.json` (written by pi-toolkit, which runs *before* pi-extensions),
+so the `~/.pi/agent/extensions/*.ts ≥ 4` assertion could sample mid-deploy and
+see fewer than 4 files under parallel build load. Observed on v1.16.2 run 370:
+`smoke-with-pi` saw `<4` while `smoke-omos-with-pi` / `smoke-pi-only` (identical
+pi-extensions `357fcc6`) both saw 8, skipping `build-variant-with-pi`. The wait
+loop now blocks until the *last*-deployed artifact (the `mempalace.ts` bridge
+symlink) exists **and** the extension count has settled ≥ 4 (up to 45s). Affects
+only when smoke samples the container — image bytes are unchanged, so this does
+not warrant a new tag; it lands in the next release and is exercised by
+`validate.yml` on this push.
 
 ## v1.16.2 — 2026-06-08
 
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 788fd89..6df9a35 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -200,10 +200,21 @@ if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v pi" >/dev/null 2>&
   trap 'docker rm -f "$CID" >/dev/null 2>&1 || true' EXIT
 
   # Wait for entrypoint-user.sh to finish deploying pi-toolkit + extensions.
-  # Marker: keybindings.json symlink lands once pi-toolkit/install.sh has run.
-  # Up to 30s — omos-with-pi has more setup work than base+pi.
-  for _ in $(seq 1 30); do
-    if docker exec "$CID" test -L /home/developer/.pi/agent/keybindings.json 2>/dev/null; then
+  # The deploy order is: pi-toolkit (writes keybindings.json) -> pi-extensions
+  # (symlinks its *.ts) -> settings.json -> mempalace.ts bridge (LAST). Gating
+  # only on keybindings.json races: it lands when pi-toolkit finishes, before
+  # pi-extensions has symlinked its *.ts, so the "*.ts >= 4" check below could
+  # sample mid-deploy under parallel build load (observed v1.16.2 run 370:
+  # smoke-with-pi saw <4 .ts while omos-with-pi/pi-only saw 8). Wait for the
+  # LAST-deployed artifact (the mempalace.ts bridge symlink) AND a settled
+  # extension count so the deploy is fully complete before any assertion runs.
+  # Up to 45s — pi-bearing variants have more setup work under load.
+  for _ in $(seq 1 45); do
+    if docker exec "$CID" sh -c \
+      'test -L $HOME/.pi/agent/keybindings.json && \
+       test -L $HOME/.pi/agent/extensions/mempalace.ts && \
+       [ "$(ls -1 $HOME/.pi/agent/extensions/*.ts 2>/dev/null | wc -l)" -ge 4 ]' \
+      2>/dev/null; then
       break
     fi
     sleep 1