diff --git a/cmd/image/lock_test.go b/cmd/image/lock_test.go
index b1fbc7e..475e1d2 100644
--- a/cmd/image/lock_test.go
+++ b/cmd/image/lock_test.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"fmt"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -126,3 +127,29 @@ func TestLocksCoverConfigs(t *testing.T) {
 		}
 	}
 }
+
+// The locks pin each recipe's package at the recipe's version and epoch: a recipe bumped without
+// task lock builds a package the lock refuses, and apko on the release builder found out
+// (construct-brand at r5, the lock at r4). CI's check, which builds no root.
+func TestLocksPinRecipesAtTheirBuild(t *testing.T) {
+	t.Chdir("../..")
+	recipes, err := readRecipes("recipes")
+	if err != nil {
+		t.Fatal(err)
+	}
+	built := map[string]string{}
+	for _, r := range recipes {
+		built[r.Name] = fmt.Sprintf("%s-r%d", r.Version, r.Epoch)
+	}
+	for _, root := range lockedRoots {
+		l, err := readLockFile(root.Lock)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, p := range l.Ours {
+			if want, ok := built[p.Name]; ok && p.Version != want {
+				t.Errorf("%s pins %s=%s, its recipe builds %s: task build -- <recipe>, then task lock", root.Lock, p.Name, p.Version, want)
+			}
+		}
+	}
+}
diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml
index b4d95bc..cfe03e7 100644
--- a/image/apko.lock.yaml
+++ b/image/apko.lock.yaml
@@ -25,7 +25,7 @@ contents:
     - code=1.145.2-r0
     - colord=1.4.8-r0
     - colord-gtk=0.3.1-r0
-    - construct-brand=0_git20261005-r4
+    - construct-brand=0_git20261005-r5
     - cracklib=2.10.4-r0
     - cracklib-lang=2.10.4-r0
     - cups-browsed=2.1.1-r1