diff --git a/.github/actions/install-r0vm/action.yml b/.github/actions/install-r0vm/action.yml
new file mode 100644
index 000000000..07c69a60a
--- /dev/null
+++ b/.github/actions/install-r0vm/action.yml
@@ -0,0 +1,36 @@
+name: Install r0vm
+description: >
+  Install the risc0 `r0vm` executor binary (via rzup) at the version matching the
+  `risc0-zkvm` crate. The fuzz targets are built WITHOUT the risc0 `prove` feature
+  (which would add ~45 min of prover-kernel compilation), so `Program::execute` runs
+  the guest through risc0's `ExternalProver`, which spawns this `r0vm` binary. Without
+  it, every public-transaction execution fails with ENOENT and is spuriously rejected —
+  which surfaces as a `ModelAcceptanceAgreement` crash in the lockstep target.
+
+inputs:
+  version:
+    description: >
+      r0vm version to install. MUST match the `risc0-zkvm` crate version — risc0 looks
+      up r0vm by exact version via rzup, and checks major/minor server compatibility.
+    required: false
+    default: "3.0.5"
+
+runs:
+  using: composite
+  steps:
+    - name: Install rzup and r0vm ${{ inputs.version }}
+      shell: bash
+      env:
+        # Authenticate rzup's GitHub release lookups to avoid unauthenticated rate limits.
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        curl -L https://risczero.com/install | bash
+        RZUP="$HOME/.risc0/bin/rzup"
+        # Install only r0vm (not the guest rust/cpp toolchains) at the pinned version.
+        "$RZUP" install r0vm "${{ inputs.version }}"
+        # risc0-zkvm resolves r0vm through the rzup home (~/.risc0); rzup also symlinks
+        # the binary into ~/.cargo/bin. Export both onto PATH for good measure.
+        echo "$HOME/.risc0/bin" >> "$GITHUB_PATH"
+        echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+        "$HOME/.cargo/bin/r0vm" --version || "$RZUP" show
diff --git a/.github/actions/setup-afl/action.yml b/.github/actions/setup-afl/action.yml
index 65ef59d7b..2946f274c 100644
--- a/.github/actions/setup-afl/action.yml
+++ b/.github/actions/setup-afl/action.yml
@@ -33,3 +33,7 @@ runs:
     - name: Install cargo-afl
       shell: bash
       run: cargo install cargo-afl --locked
+
+    # The fuzz targets execute guest programs via risc0's ExternalProver, which needs r0vm.
+    - name: Install r0vm
+      uses: ./.github/actions/install-r0vm
diff --git a/.github/actions/setup-libfuzzer/action.yml b/.github/actions/setup-libfuzzer/action.yml
index 3a22d8655..a9b14b91a 100644
--- a/.github/actions/setup-libfuzzer/action.yml
+++ b/.github/actions/setup-libfuzzer/action.yml
@@ -1,7 +1,7 @@
 name: Set up libFuzzer toolchain
 description: >
   Install the Rust nightly toolchain (with llvm-tools-preview, required by
-  cargo-fuzz and llvm-cov) and cargo-fuzz itself. The repository and
+  cargo-fuzz and llvm-cov), cargo-fuzz, and the r0vm executor. The repository and
   logos-execution-zone must already be checked out before this runs.
 
 runs:
@@ -15,3 +15,7 @@ runs:
     - name: Install cargo-fuzz
       shell: bash
       run: cargo install cargo-fuzz
+
+    # The fuzz targets execute guest programs via risc0's ExternalProver, which needs r0vm.
+    - name: Install r0vm
+      uses: ./.github/actions/install-r0vm
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 26e25fa31..6864954d4 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -5,7 +5,7 @@ on:
     - cron: "0 2 * * *"
   workflow_dispatch:
   push:
-    branches: [main, feat-afl-fuzzing]
+    branches: [main, fix-fuzz-stateful-model-lockstep]
 
 env:
   RISC0_DEV_MODE: "1"
diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index 825fff561..27c03314c 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -136,6 +136,11 @@ jobs:
           cargo install cargo-fuzz --locked
           cargo install cargo-mutants --locked
 
+      # The corpus oracle runs the fuzz targets, which execute guest programs via
+      # risc0's ExternalProver — that needs the r0vm binary.
+      - name: Install r0vm
+        uses: ./.github/actions/install-r0vm
+
       - name: Make corpus-regression wrapper executable
         run: chmod +x scripts/mutants-corpus-test.sh
 
diff --git a/fuzz_props/Cargo.toml b/fuzz_props/Cargo.toml
index b4454f856..392d6d258 100644
--- a/fuzz_props/Cargo.toml
+++ b/fuzz_props/Cargo.toml
@@ -11,6 +11,13 @@ fuzzer-libfuzzer = []
 fuzzer-afl       = []
 
 [dependencies]
+# NOTE: `prove` is deliberately NOT enabled here. Enabling it drags risc0's STARK
+# prover backend (C++/CUDA kernels + heavy circuit codegen) into the fuzz-target
+# build, blowing "cargo fuzz build" from ~6 min to ~50 min — all to compile a prover
+# that `Program::execute` never calls (it executes, it does not prove). Instead the
+# fuzz targets use risc0's `ExternalProver`, which runs the guest via an external
+# `r0vm` binary installed in CI (see .github/actions/install-r0vm). It is still
+# enabled under [dev-dependencies] so `cargo test` runs the guest in-process.
 nssa       = { workspace = true }
 nssa_core  = { workspace = true }
 common     = { workspace = true }
@@ -28,4 +35,5 @@ system_accounts = { workspace = true }
 
 [dev-dependencies]
 proptest = "1.4"
+# In-process guest execution for the test suite (no external r0vm needed under `cargo test`).
 nssa = { workspace = true, features = ["prove"] }