diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 5ab8b51..a4bad24 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -31,6 +31,15 @@ on:
         description: One of yarn, npm, or pnpm.
         type: string
         default: yarn
+      lfs:
+        description: >
+          Fetch Git LFS objects during checkout. Off by default: LFS pulls cost
+          bandwidth against the account quota on every run. Turn it on for a
+          repo whose tests read LFS-tracked fixtures — without it they get the
+          pointer files, and fail with whatever the reading library says about
+          malformed input rather than anything about LFS.
+        type: boolean
+        default: false
       run-build:
         description: Run the build script after type-checking.
         type: boolean
@@ -52,6 +61,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+          lfs: ${{ inputs.lfs }}
 
       # Honours the `packageManager` field in package.json, which is how Yarn
       # Berry and pnpm pin themselves.
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index a8e2209..8600679 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -29,6 +29,15 @@ on:
           Mirrors the same input on node-ci.yml.
         type: string
         default: "."
+      lfs:
+        description: >
+          Fetch Git LFS objects during checkout. Off by default: LFS pulls cost
+          bandwidth against the account quota on every run. Turn it on for a
+          repo whose tests read LFS-tracked fixtures — without it they get the
+          pointer files, and fail with whatever the reading library says about
+          malformed input rather than anything about LFS.
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -46,6 +55,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+          lfs: ${{ inputs.lfs }}
 
       - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d4e3d1..02da109 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,10 @@ Entries for 1.0.0 through 1.5.2 were backfilled from git history after the fact,
 
 ## [Unreleased]
 
+### Added
+
+- `python-ci.yml` and `node-ci.yml` take an `lfs` input, passed through to `actions/checkout`. It defaults to `false`, because an LFS pull costs bandwidth against the account quota on every run and most projects have nothing in LFS. Turn it on for a repo whose tests read LFS-tracked fixtures: without it the checkout produces pointer files, and the failure surfaces as whatever the reading library says about malformed input — `FzErrorFormat: no objects found` from PyMuPDF, in the case that prompted this — with nothing anywhere in the output mentioning LFS.
+
 ### Fixed
 
 - The scaffolded typos hook skips `.copier-answers.yml`. The file is generated, and its `_commit` is whatever ref the last update used — when that is a short SHA rather than a tag, its leading hex characters are a coin flip away from a word typos reads as misspelled, and `ba338ef` duly tripped `ba` → `by`, `be`. Nothing in the file is prose, so checking it could only ever produce false positives, on a schedule nobody controls.