diff --git a/.github/workflows/php.yaml b/.github/workflows/php.yaml
index dbdff68..f1d2939 100644
--- a/.github/workflows/php.yaml
+++ b/.github/workflows/php.yaml
@@ -87,8 +87,14 @@ jobs:
           flags: unittests
 
   mutation-tests:
-    name: Mutation tests
+    name: Mutation tests (${{ matrix.php }}, ${{ matrix.prefer }})
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - service: phpfpm
+            php: "8.3"
+            prefer: prefer-stable
     steps:
       - uses: actions/checkout@v6
 
@@ -106,7 +112,7 @@ jobs:
         env:
           STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}
         run: |
-          docker compose run --rm phpfpm composer install
+          docker compose run --rm ${{ matrix.service }} composer install
           docker compose run --rm \
             -e XDEBUG_MODE=coverage \
             -e GITHUB_ACTIONS \
@@ -118,4 +124,4 @@ jobs:
             -e GITHUB_RUN_ID \
             -e GITHUB_SERVER_URL \
             -e STRYKER_DASHBOARD_API_KEY \
-            phpfpm vendor/bin/infection --logger-github
+            ${{ matrix.service }} vendor/bin/infection --logger-github
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca3ae1f..bdac88e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- CI: the mutation-tests job declares its PHP version and dependency set
+  via a single-entry matrix (`Mutation tests (8.3, prefer-stable)`), so
+  the job name makes explicit what mutation testing runs on. No effect on
+  the published package.
 - Dev: test fixtures use RFC 2606 reserved domains only —
   `provider.example.org` for IdP-side URLs (metadata, authorization) and
   `app.example.org` for application-side URLs (redirect/callback, CLI