diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index 7e0e02b..286ed62 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -51,7 +51,7 @@ jobs:
             echo "tag v$VERSION already exists on origin"; exit 1
           fi
 
-          PACKAGE_VERSION="$(cargo metadata --no-deps --format-version 1 | \
+          PACKAGE_VERSION="$(cargo metadata --locked --no-deps --format-version 1 | \
             python3 -c 'import json, sys; print(next(p["version"] for p in json.load(sys.stdin)["packages"] if p["name"] == "wright-cli"))')"
           if [[ "$VERSION" != "$PACKAGE_VERSION" ]]; then
             python3 - "$VERSION" <<'PY'
@@ -69,6 +69,11 @@ jobs:
           path.write_text(updated)
           PY
 
+            # A workspace package-version bump changes the version recorded for
+            # workspace packages in Cargo.lock. Update that manifest-derived
+            # lockfile state, then prove the result is clean in locked mode.
+            cargo metadata --no-deps --format-version 1 >/dev/null
+            cargo metadata --locked --no-deps --format-version 1 >/dev/null
           fi
 
           python3 scripts/update-dist-manifests.py --version "$VERSION"
@@ -76,7 +81,7 @@ jobs:
 
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Cargo.toml dist
+          git add Cargo.toml Cargo.lock dist
           git diff --cached --check
           if ! git diff --cached --quiet; then
             git commit -m "chore(release): bump version to $VERSION"