diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a1fe0b8..7802154 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,14 +14,14 @@ jobs:
         with:
           components: clippy, rustfmt
       - run: cargo fmt --check
-      - run: cargo clippy -- -D warnings
+      - run: cargo clippy --locked -- -D warnings
 
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@1.86.0
-      - run: cargo test --tests
+      - run: cargo test --locked --tests
 
   check-macos:
     runs-on: macos-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ea6a475..b47b7ea 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@1.86.0
-      - run: cargo test
+      - run: cargo test --locked
 
   publish:
     needs: test
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@1.86.0
       - name: Publish to crates.io
-        run: cargo publish
+        run: cargo publish --locked
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4f46b6..4981177 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.18.4 (2026-05-09)
+
+### Build / CI hardening — no library code changes
+
+- All `cargo` invocations in `.github/workflows/*.yml` now use
+  `--locked`. Previously `cargo build` / `cargo test` could silently
+  re-resolve `Cargo.lock` if a lock-pinned version wasn't yet on
+  crates.io — masking dependency races between same-tag releases of
+  sibling crates. The 0.18.3 release hit this: autorip's docker image
+  built `libfreemkv v0.18.2` because libfreemkv 0.18.3 hadn't
+  published yet at the time autorip's CI ran, and cargo silently fell
+  back to the previous version. With `--locked`, that race now hard-
+  fails the build with a clear "package X is not in registry" error
+  and we retrigger after the upstream lands.
+
+- `cargo publish --locked` in the release workflow guards against
+  publishing a lockfile-mismatched release.
+
 ## 0.18.3 (2026-05-09)
 
 ### Behaviour change
diff --git a/Cargo.toml b/Cargo.toml
index cde507c..cdbe528 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "libfreemkv"
-version = "0.18.3"
+version = "0.18.4"
 edition = "2024"
 rust-version = "1.86"
 license = "AGPL-3.0-only"