diff --git a/registry/repos.schema.json b/registry/repos.schema.json
index a10fe14d..032838f4 100644
--- a/registry/repos.schema.json
+++ b/registry/repos.schema.json
@@ -33,7 +33,7 @@
             "required": ["name", "url", "status"],
             "allOf": [
                 {
-                    "comment": "An operational repo must declare its line endings (release repos use the fleet CRLF default).",
+                    "$comment": "An operational repo must declare its line endings (release repos use the fleet CRLF default).",
                     "if": { "properties": { "workflowModel": { "const": "operational" } }, "required": ["workflowModel"] },
                     "then": { "required": ["lineEndings"] }
                 }
diff --git a/spec/validate.py b/spec/validate.py
index 00b89988..6787404e 100644
--- a/spec/validate.py
+++ b/spec/validate.py
@@ -128,8 +128,11 @@ def check_secret_set(label, entry, need_kind):
         if eol is not None and eol not in ("lf", "crlf"):
             errors.append(f"{name}: lineEndings '{eol}' invalid (expected lf or crlf)")
         # An operational repo's endings follow the consuming app's platform, so they must be declared; a release
-        # repo omits the field and uses the fleet CRLF default.
-        if model == "operational" and eol is None:
+        # repo omits the field and uses the fleet CRLF default. Resolve the effective model the same way
+        # configure.sh does (repo -> defaults -> release) so the requirement holds even if a repo relies on an
+        # operational defaults.workflowModel rather than setting it explicitly.
+        effective_model = model or default_model or "release"
+        if effective_model == "operational" and eol is None:
             errors.append(f"{name}: operational repo must declare lineEndings (lf or crlf)")
 
         required = set(repo.get("requiredSecrets", []))