diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index d3ca3802..90de2f53 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -208,8 +208,10 @@ jobs:
   # repository by git, which this workflow's token cannot clone, so it runs
   # locally before a release (`cargo test --locked --manifest-path
   # test/w5-policy-runtime-node-e2e/Cargo.toml`); a CI job needs a read token
-  # for that repository first. test/load/signer is covered by no job at all.
-  # Recorded here rather than left implicit.
+  # for that repository first, and its lockfile is not checked in CI yet.
+  # test/load/signer is built by no job. The `lockfiles` job below resolves
+  # main, m1-realdata-e2e and test/load/signer with --locked. Recorded here
+  # rather than left implicit.
   m1-realdata:
     runs-on: ubuntu-latest
     env:
@@ -239,6 +241,28 @@ jobs:
     - name: Run deterministic M1 contract tests
       run: cargo test --locked --manifest-path test/m1-realdata-e2e/Cargo.toml
 
+  # TC-887: every separate workspace's Cargo.lock must stay current for the
+  # in-repo crates it uses by path, or `cargo ... --locked` breaks there. The
+  # jobs above build only the main workspace and m1-realdata-e2e. This job
+  # resolves each workspace CI can fetch with --locked (w5's private git
+  # dependency is not fetchable here; see above).
+  lockfiles:
+    name: separate workspace lockfiles
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+    steps:
+    - name: Checkout TinyCloud repository
+      uses: actions/checkout@v4
+    - uses: dtolnay/rust-toolchain@1.97.1
+    - name: Resolve each fetchable workspace with --locked
+      run: |
+        for manifest in Cargo.toml test/m1-realdata-e2e/Cargo.toml test/load/signer/Cargo.toml; do
+          echo "cargo metadata --locked --manifest-path $manifest"
+          cargo metadata --locked --format-version 1 --manifest-path "$manifest" > /dev/null
+        done
+
   # TC-887 S0: a real node on native PostgreSQL and native MinIO (no service
   # containers). MinIO/mc are pinned community releases whose sha256 is pinned
   # in harness.sh; PostgreSQL is the runner image's own native install. The
diff --git a/test/w5-policy-runtime-node-e2e/Cargo.lock b/test/w5-policy-runtime-node-e2e/Cargo.lock
index 431ccf7c..29f068d0 100644
--- a/test/w5-policy-runtime-node-e2e/Cargo.lock
+++ b/test/w5-policy-runtime-node-e2e/Cargo.lock
@@ -46,6 +46,7 @@ dependencies = [
  "cfg-if",
  "cipher",
  "cpufeatures 0.2.17",
+ "zeroize",
 ]
 
 [[package]]
@@ -60,6 +61,7 @@ dependencies = [
  "ctr",
  "ghash",
  "subtle",
+ "zeroize",
 ]
 
 [[package]]
@@ -8182,6 +8184,7 @@ dependencies = [
 name = "tinycloud-core"
 version = "1.3.0"
 dependencies = [
+ "aes",
  "aes-gcm",
  "arrow",
  "async-trait",
@@ -8191,6 +8194,7 @@ dependencies = [
  "duckdb",
  "futures",
  "hex",
+ "hkdf",
  "hmac",
  "k256",
  "libp2p",
@@ -8219,6 +8223,7 @@ dependencies = [
  "unicode-normalization",
  "uuid",
  "x25519-dalek",
+ "zeroize",
 ]
 
 [[package]]