diff --git a/Package.swift b/Package.swift
index 39f1562..9b1684e 100644
--- a/Package.swift
+++ b/Package.swift
@@ -25,6 +25,9 @@ let package = Package(
             name: "PureXMLTests",
             dependencies: ["PureXML"],
             path: "Tests",
+            // The vendored XSTS archive is consumed off-disk via XSTS_ROOT, never
+            // from the test bundle, so keep it out of the copied resources.
+            exclude: ["Fixtures/xsts"],
             resources: [
                 .copy("Fixtures"),
             ],
diff --git a/Tests/Fixtures/xsts/README.md b/Tests/Fixtures/xsts/README.md
new file mode 100644
index 0000000..26228ec
--- /dev/null
+++ b/Tests/Fixtures/xsts/README.md
@@ -0,0 +1,31 @@
+# W3C XML Schema Test Suite (XSTS): vendored archive
+
+`xsts-2007-06-20.tar.gz` is the complete, unmodified W3C XML Schema Test Suite,
+2006-11-06 release (14,383 settled cases across roughly 39,399 files), exactly as
+published by the W3C.
+
+- Source: <https://www.w3.org/XML/2004/xml-schema-test-suite/xmlschema2006-11-06/xsts-2007-06-20.tar.gz>
+- SHA-256: `902176b25e4111cf96b08663107521a4992e8ea67aad6b815592a6a5b4b9ea06`
+- Size: 4,367,182 bytes
+
+## License
+
+The suite is published under the W3C Document License, which permits
+redistribution only as the complete, unmodified archive. This file is that
+archive, byte for byte, kept in its original `.tar.gz` form for that reason.
+
+Do not commit the extracted files. Extracting them and committing the loose
+files is a modified redistribution and is not permitted by the license. Keep the
+archive sealed; extract it locally instead (see below).
+
+## Use
+
+Extract it to the path the conformance runner expects, then point `XSTS_ROOT` at
+the result:
+
+    bash scripts/fetch-xsts.sh
+    export XSTS_ROOT=/private/tmp/xsts/xmlschema2006-11-06
+    XSTS_ROOT=$XSTS_ROOT swift test -c release --filter XSTSSuiteTests
+
+`scripts/fetch-xsts.sh` extracts this vendored archive when it is present (no
+network needed) and falls back to downloading it from the W3C otherwise.
diff --git a/Tests/Fixtures/xsts/xsts-2007-06-20.tar.gz b/Tests/Fixtures/xsts/xsts-2007-06-20.tar.gz
new file mode 100644
index 0000000..df5e723
Binary files /dev/null and b/Tests/Fixtures/xsts/xsts-2007-06-20.tar.gz differ
diff --git a/scripts/fetch-xsts.sh b/scripts/fetch-xsts.sh
index 6d6c0a3..3bb2466 100755
--- a/scripts/fetch-xsts.sh
+++ b/scripts/fetch-xsts.sh
@@ -2,10 +2,11 @@
 # Fetch the W3C XML Schema Test Suite (XSTS, 2006-11-06 release) to the path the
 # conformance runner (Tests/XSTSSuiteTests.swift) expects.
 #
-# The suite is never vendored: the W3C Document License permits redistribution
-# only as the complete unmodified archive, and the corpus is about 200 MB across
-# 39,399 files. This script downloads the official archive on demand and verifies
-# its SHA-256 before extracting.
+# The extracted suite is never vendored: the W3C Document License permits
+# redistribution only as the complete unmodified archive, and the corpus is about
+# 200 MB across 39,399 files. The unmodified archive itself is vendored at
+# Tests/Fixtures/xsts; this script extracts that when present (no network), or
+# downloads the official archive otherwise, verifying its SHA-256 before extracting.
 #
 # Usage:
 #   bash scripts/fetch-xsts.sh
@@ -28,8 +29,15 @@ fi
 
 mkdir -p "$dest"
 archive="$dest/xsts-2007-06-20.tar.gz"
-echo "xsts: downloading the 2006-11-06 archive (about 4.4 MB)"
-curl -fsSL -o "$archive" "$url"
+script_dir="$(cd "$(dirname "$0")" && pwd)"
+vendored="$script_dir/../Tests/Fixtures/xsts/xsts-2007-06-20.tar.gz"
+if [ -f "$vendored" ]; then
+  echo "xsts: using the vendored archive (no download)"
+  cp "$vendored" "$archive"
+else
+  echo "xsts: downloading the 2006-11-06 archive (about 4.4 MB)"
+  curl -fsSL -o "$archive" "$url"
+fi
 
 # Verify integrity before extracting (portable across macOS and Linux).
 if command -v shasum >/dev/null 2>&1; then