diff --git a/demo/audit-demo.mjs b/demo/audit-demo.mjs
index e655fb2..825a122 100644
--- a/demo/audit-demo.mjs
+++ b/demo/audit-demo.mjs
@@ -61,7 +61,7 @@ L('\n  The edit is silent in the file but LOUD in the chain: you cannot rewrite
 L('  without breaking the seal.');
 
 // The other tamper a plain chain can't see: DELETING the newest verdicts. A valid
-// PREFIX still verifies — so redstamp 0.5.1 pins the head. The gate keeps the chain
+// PREFIX still verifies — so redstamp (since 0.5.1) pins the head. The gate keeps the chain
 // head + length in memory as it records (a checkpoint an on-disk attacker can't
 // reach); verifying against it catches a truncation the bare chain waves through.
 const fresh = runTrilogy();
@@ -74,7 +74,7 @@ const vsCheckpoint = verifyAuditFile(fresh.trailPath, checkpoint);
 L('\nA sneakier tamper — the attacker DELETES the last two verdicts instead of editing one:');
 L('  verifyAuditFile() alone     → ' + JSON.stringify(barePrefix) + '   ⚠️  a truncated prefix still checks out');
 L('  …against the gate\'s checkpoint → ' + JSON.stringify(vsCheckpoint) + '   ❌ TRUNCATION caught');
-L('\n  redstamp 0.5.1 anchors the chain head, so truncating the newest entries is caught too —');
+L('\n  redstamp (since 0.5.1) anchors the chain head, so truncating the newest entries is caught too —');
 L('  the same protection strongroom gives its secret-access log with an HMAC tip.');
 L('  strongroomAudit.verify(): ' + JSON.stringify(strongroomAudit.verify()));
 
diff --git a/package-lock.json b/package-lock.json
index 3922e02..e5210e9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,8 +10,8 @@
       "license": "MIT",
       "dependencies": {
         "@askalf/redstamp": "git+https://github.com/askalf/redstamp.git#5222bc1b0c1e5dd3daf77078fd964f9c2215fe29",
-        "@askalf/strongroom": "git+https://github.com/askalf/strongroom.git#43c9ca600ced5f9acc755590bc324e95764a5195",
-        "@askalf/truecopy": "git+https://github.com/askalf/truecopy.git#951460e003ab16ef86ea5f297c6523c09b4fba4e",
+        "@askalf/strongroom": "git+https://github.com/askalf/strongroom.git#94b653bf8e3157226fd9c16330711b5b10ce7414",
+        "@askalf/truecopy": "git+https://github.com/askalf/truecopy.git#32638be89127f8aa9922b8add02843dac7bc7cce",
         "@modelcontextprotocol/sdk": "^1.30.0",
         "zod": "^4.4.3"
       },
@@ -42,13 +42,10 @@
       }
     },
     "node_modules/@askalf/strongroom": {
-      "version": "0.2.1",
-      "resolved": "git+ssh://git@github.com/askalf/strongroom.git#43c9ca600ced5f9acc755590bc324e95764a5195",
-      "integrity": "sha512-V233EmQkoruosCMd9EE3wl/TAW9AJw1thqoWgrnmypUCi/s8UKtHV0lc1hzK1uGhrGPhdUwBlXBLGCfuc/LRPA==",
+      "version": "0.4.0",
+      "resolved": "git+ssh://git@github.com/askalf/strongroom.git#94b653bf8e3157226fd9c16330711b5b10ce7414",
+      "integrity": "sha512-w0OWBBChJuNMf4975E4KtMrjRuE+VKwmYA9BzHxY0ZvNb/o1TWRJ49h4t9gzXJNchEQ0zCXqgHuliT8Fj96s9Q==",
       "license": "MIT",
-      "dependencies": {
-        "@askalf/redstamp": "github:askalf/redstamp#3da60b9d720cb3f152f3db906673be0a2f8116b7"
-      },
       "bin": {
         "keeper": "src/cli.mjs",
         "strongroom": "src/cli.mjs"
@@ -58,12 +55,12 @@
       }
     },
     "node_modules/@askalf/truecopy": {
-      "version": "0.8.0",
-      "resolved": "git+ssh://git@github.com/askalf/truecopy.git#951460e003ab16ef86ea5f297c6523c09b4fba4e",
-      "integrity": "sha512-KelAhlNnq0ozldTpfuFgOLuJgx4aZ+dFlhufpkefFVnD5lcjjPlr5RjbQGLrrMRr8WCdBpD+2FAgTK9ggrwvYg==",
+      "version": "0.10.3",
+      "resolved": "git+ssh://git@github.com/askalf/truecopy.git#32638be89127f8aa9922b8add02843dac7bc7cce",
+      "integrity": "sha512-AWJlnjrjAMQS7ee8WFwj7Iv+OB4QWoobH12qUdodo+YNnVSdVhMqOV2BKot6PC1t92n2eZPSex14yUPLZt/hLw==",
       "license": "MIT",
       "dependencies": {
-        "@askalf/redstamp": "github:askalf/redstamp#3da60b9d720cb3f152f3db906673be0a2f8116b7"
+        "@askalf/redstamp": "https://github.com/askalf/redstamp/releases/download/v0.7.5/askalf-redstamp-0.7.5.tgz"
       },
       "bin": {
         "canon": "src/cli.mjs",
diff --git a/package.json b/package.json
index f7ef0bd..a2cdac7 100644
--- a/package.json
+++ b/package.json
@@ -17,8 +17,8 @@
   },
   "dependencies": {
     "@askalf/redstamp": "git+https://github.com/askalf/redstamp.git#5222bc1b0c1e5dd3daf77078fd964f9c2215fe29",
-    "@askalf/truecopy": "git+https://github.com/askalf/truecopy.git#951460e003ab16ef86ea5f297c6523c09b4fba4e",
-    "@askalf/strongroom": "git+https://github.com/askalf/strongroom.git#43c9ca600ced5f9acc755590bc324e95764a5195",
+    "@askalf/truecopy": "git+https://github.com/askalf/truecopy.git#32638be89127f8aa9922b8add02843dac7bc7cce",
+    "@askalf/strongroom": "git+https://github.com/askalf/strongroom.git#94b653bf8e3157226fd9c16330711b5b10ce7414",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3"
   },