diff --git a/.forgejo/workflows/check-rust.yml b/.forgejo/workflows/check-rust.yml
index f864f69..ef37ebd 100644
--- a/.forgejo/workflows/check-rust.yml
+++ b/.forgejo/workflows/check-rust.yml
@@ -126,8 +126,15 @@ jobs:
         with:
           workspaces: "src-tauri -> target"
 
+      # --locked (#449): a Cargo.lock that no longer matches Cargo.toml (hand
+      # edit, conflict resolved badly, dependency added without its lockfile)
+      # fails the job here instead of being rewritten in the job's checkout.
+      # The guards and the audit below then read the committed lockfile, the
+      # one release.yml builds the shipped binaries from, also with --locked.
+      # A deliberate `cargo update` in a PR is not affected: it commits the
+      # lockfile it writes.
       - name: cargo check
-        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets
+        run: cargo check --manifest-path src-tauri/Cargo.toml --all-targets --locked
 
       # Anti-rot guard for the suppressions in .cargo/audit.toml (#310). Each
       # entry there is justified by its crate being absent from every shipped
@@ -218,9 +225,10 @@ jobs:
       # and a canary must be read and checked, or the loop's silence proves
       # nothing.
       #
-      # No cargo call, so neither the warm index nor --locked matters here: the
-      # step reads the lockfile as cargo check left it, which is the committed
-      # one unless cargo had to update it.
+      # No cargo call, so neither the warm index nor --locked matters here. The
+      # lockfile it reads is the committed one: cargo check runs with --locked
+      # and has already failed the job on a lockfile cargo would have had to
+      # rewrite (#449).
       - name: Verify windows-sys pinning
         run: |
           set -u
@@ -330,8 +338,9 @@ jobs:
           echo "windows-sys pinning: $checks checks, exit $rc"
           exit $rc
 
+      # --locked, as cargo check above (#449).
       - name: cargo test
-        run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets
+        run: cargo test --manifest-path src-tauri/Cargo.toml --all-targets --locked
 
       # Prebuilt binary. `cargo install --locked cargo-audit` recompiled the
       # tool from source on every single run (~4m40s). No continue-on-error:
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 79eb542..f1aa963 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -43,7 +43,15 @@ jobs:
         run: |
           apt-get install -y lld llvm clang nsis
           rustup target add x86_64-pc-windows-msvc
-          cargo install --locked cargo-xwin
+          # Pinned (#449): cargo-xwin is the runner of the Windows build below
+          # and runs with TAURI_SIGNING_PRIVATE_KEY in its environment, so a
+          # new release of it must be a decision, not whatever crates.io serves
+          # on the day of the tag. 0.23.1 is the version the v0.17.2 release
+          # installed unpinned (run 570). A version without an operator makes
+          # cargo install exactly that one. Bump it on purpose, after reading
+          # what the new version changes.
+          cargo install --locked cargo-xwin --version 0.23.1
+          cargo-xwin --version
 
       - name: Install frontend dependencies
         run: npm ci
@@ -53,14 +61,21 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
-          npx tauri build --bundles deb,rpm
+          # Arguments after -- go to the runner (#449): cargo here, cargo-xwin
+          # in the Windows step, which hands them to cargo build. --locked
+          # builds the shipped binaries from the committed Cargo.lock, or fails
+          # rather than rewrite it. The log never prints the cargo command
+          # line: only a build that fails on a lockfile out of step with
+          # Cargo.toml proves the flag gets there.
+          npx tauri build --bundles deb,rpm -- --locked
 
       - name: Build Tauri Windows
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
-          npx tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc
+          # -- --locked: see the Linux build above (#449).
+          npx tauri build --runner cargo-xwin --target x86_64-pc-windows-msvc -- --locked
 
       - name: Collect release files
         run: |