diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e2574c..0548b4a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,8 +80,13 @@ jobs:
           cargo clippy --manifest-path crates/tinymemory-module/Cargo.toml
           --all-targets -- -D warnings
 
+      # `--locked`, matching how the release builds this crate. Without it, a
+      # stale `crates/tinymemory-module/Cargo.lock` — which is a *separate*
+      # lockfile from the root's, and easy to forget when the root version moves
+      # — passes here and then fails all eleven release bundle jobs, after the
+      # tag has already been pushed. That happened once; this is the guard.
       - name: Build the cdylib
-        run: cargo build --manifest-path crates/tinymemory-module/Cargo.toml --release
+        run: cargo build --locked --manifest-path crates/tinymemory-module/Cargo.toml --release
 
       - name: Unit tests
         run: cargo test --manifest-path crates/tinymemory-module/Cargo.toml --lib
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75164d4..11e86f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -160,6 +160,24 @@ jobs:
           perl -0pi -e 's/(\[package\][\s\S]*?\nversion = ")[^"]+(")/$1$ENV{NEXT_VERSION}$2/' Cargo.toml
           cargo update -p "$CRATE_NAME" --precise "$NEXT_VERSION"
 
+          # There are TWO Cargo worlds here, and the module's is the one the
+          # release actually builds. `crates/tinymemory-module` is its own
+          # workspace root with its own `Cargo.lock` (see the root Cargo.toml
+          # comment for why), and it depends on the root crate by path — so
+          # bumping the root version leaves that lockfile recording the old one.
+          #
+          # `native-bundles` then builds with `--locked` and every one of the
+          # eleven jobs fails with "cannot update the lock file … because
+          # --locked was passed". Updating only the root lockfile is how the
+          # second attempt at this release died, after the tag had already been
+          # pushed.
+          cargo update --manifest-path crates/tinymemory-module/Cargo.toml \
+            -p "$CRATE_NAME" --precise "$NEXT_VERSION"
+
+          # Prove it before tagging rather than discovering it eleven jobs later.
+          cargo metadata --locked --format-version 1 \
+            --manifest-path crates/tinymemory-module/Cargo.toml >/dev/null
+
       - name: Commit version bump and tag
         env:
           RELEASE_TAG: ${{ steps.version.outputs.tag }}
@@ -167,7 +185,10 @@ jobs:
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Cargo.toml Cargo.lock
+          # Both lockfiles: the module's own workspace lock is what the bundle
+          # jobs build against with `--locked`, so a tag that omits it cannot be
+          # built at all.
+          git add Cargo.toml Cargo.lock crates/tinymemory-module/Cargo.lock
           git commit -m "Release ${RELEASE_TAG}"
           git tag -a "${RELEASE_TAG}" -m "Release ${RELEASE_TAG}"
 
diff --git a/crates/tinymemory-module/Cargo.lock b/crates/tinymemory-module/Cargo.lock
index 6d26aae..e5eca04 100644
--- a/crates/tinymemory-module/Cargo.lock
+++ b/crates/tinymemory-module/Cargo.lock
@@ -1726,7 +1726,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -1875,7 +1875,7 @@ dependencies = [
 
 [[package]]
 name = "tinymemory"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "anyhow",
  "async-trait",