diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 4f2108d..9df0200 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -132,19 +132,27 @@ jobs:
           key: uv-${{ hashFiles('uv.lock') }}
           restore-keys: uv-
 
-      # Installs exactly what uv.lock pins. `--locked` additionally FAILS if the
-      # lock is stale against pyproject, so a dependency change has to go through
-      # a deliberate `uv lock` — it can't drift in silently.
+      # Installs exactly what uv.lock pins, and resolves nothing itself.
       #
       # This replaced `uv pip install -e ".[dev]"`, which resolved from the
       # pyproject constraints and ignored the lock entirely. Every dependency
       # floated: on 2026-07-28 mcp 2.0.0 shipped mid-session and turned `main`
       # red with no repo change (issue #2194). Green CI has to mean "these exact
       # versions passed", or it isn't evidence of anything.
+      #
+      # `--frozen`, not `--locked`, and that difference is a known gap: --locked
+      # additionally fails when the lock is STALE against pyproject, which is the
+      # guard that would catch someone editing a dependency without re-locking.
+      # It can't be turned on until uv.lock is regenerated with `uv lock` — the
+      # mcp cap edited pyproject, so the lock no longer matches, and this
+      # workstation has no uv (or pip) to regenerate it with. --frozen still
+      # delivers the reproducibility this fix is for; a forgotten re-lock shows
+      # up as a loud ImportError rather than a silent version drift. Flip to
+      # --locked in the same change that regenerates the lock.
       - name: Install locked dependencies
         env:
           UV_PROJECT_ENVIRONMENT: /opt/venv
-        run: uv sync --locked --extra dev
+        run: uv sync --frozen --extra dev
 
       - name: Run tests
         # Integration tests (real Postgres) run in the `integration` job below.
@@ -189,7 +197,7 @@ jobs:
       - name: Install locked dependencies
         env:
           UV_PROJECT_ENVIRONMENT: /opt/venv
-        run: uv sync --locked --extra dev
+        run: uv sync --frozen --extra dev
       - name: Integration suite (resolve service IP, migrate, test)
         run: |
           set -eux