diff --git a/pkg/parser/schema_location_test.go b/pkg/parser/schema_location_test.go
index 9de502332c4..a01fc309d9a 100644
--- a/pkg/parser/schema_location_test.go
+++ b/pkg/parser/schema_location_test.go
@@ -360,6 +360,16 @@ func TestValidateMainWorkflowFrontmatterWithSchemaAndLocation_AdditionalProperti
 			wantErr:     true,
 			errContains: "requird",
 		},
+		{
+			name: "top-level roles field is rejected pointing to on.roles",
+			frontmatter: map[string]any{
+				"on":    "push",
+				"roles": []string{"admin", "maintainer", "write"},
+			},
+			filePath:    "/test/workflow.md",
+			wantErr:     true,
+			errContains: "'roles' belongs under 'on'",
+		},
 		{
 			name: "dispatch-repository key is accepted by schema",
 			frontmatter: map[string]any{