diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 83722cc..44a4200 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -121,6 +121,16 @@ jobs:
           key: ${{ github.job }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
           restore-keys: ${{ github.job }}-cargo-
 
+      - name: Sync the lockfile to the workspace version
+        # Bumping [workspace.package] version leaves Cargo.lock pinning the old
+        # member versions, and --locked then refuses to build. `cargo update -w`
+        # re-resolves only the workspace members and leaves every third-party pin
+        # alone - it reports the others as "unchanged dependencies behind latest"
+        # rather than bumping them. So --locked below still catches the case that
+        # actually matters: a dependency added or bumped without committing the
+        # lockfile, which this cannot and should not paper over.
+        run: cargo update -w
+
       - name: Build
         run: cargo build --release --locked -p quicksearch-gui
 
@@ -231,6 +241,11 @@ jobs:
           key: ${{ github.job }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
           restore-keys: ${{ github.job }}-cargo-
 
+      - name: Sync the lockfile to the workspace version
+        # Same reasoning as the linux job: workspace members only, third-party
+        # pins untouched, so --locked keeps its teeth.
+        run: cargo update -w
+
       - name: Build
         # rust-toolchain.toml already lists the target, so no `rustup target add`.
         run: cargo build --release --locked -p quicksearch-gui --target "$TARGET"
diff --git a/Cargo.lock b/Cargo.lock
index e396777..b602e65 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3190,7 +3190,7 @@ dependencies = [
 
 [[package]]
 name = "quicksearch-core"
-version = "0.9.0"
+version = "0.9.1"
 dependencies = [
  "argon2",
  "chardetng",
@@ -3222,7 +3222,7 @@ dependencies = [
 
 [[package]]
 name = "quicksearch-gui"
-version = "0.9.0"
+version = "0.9.1"
 dependencies = [
  "chrono",
  "eframe",
diff --git a/README.md b/README.md
index d525eab..41984f7 100644
--- a/README.md
+++ b/README.md
@@ -390,8 +390,11 @@ pagination: the table is virtualized, so a single scroll list capped at
   snippet_perf -- --nocapture`: snippet pipeline benchmark.
 - `.forgejo/workflows/ci.yml`: builds both platforms on every push to `master`
   and every pull request. To cut a release, bump `[workspace.package] version`
-  in `Cargo.toml`, run `cargo update -w` so the lockfile agrees (CI builds with
-  `--locked`), and push the commit on a branch named `Release...`. Once both
+  in `Cargo.toml` and push the commit on a branch named `Release...`; CI runs
+  `cargo update -w` first, so a lockfile still pinning the old member versions
+  is not something you have to remember. That only re-resolves the workspace
+  crates, so the `--locked` build after it still fails on a dependency added or
+  bumped without committing `Cargo.lock`. Once both
   build jobs are green, CI tags that commit `v<version>` and publishes a release
   with the `.deb`, a Linux tarball and a Windows zip attached; pushing a `v*`
   tag by hand does the same thing. The version is never taken from the branch