diff --git a/.github/workflows/printing.yml b/.github/workflows/printing.yml
index 1b0573a5a4..3bfa5cfc44 100644
--- a/.github/workflows/printing.yml
+++ b/.github/workflows/printing.yml
@@ -81,12 +81,13 @@ jobs:
             pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
             libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev libvulkan1 mesa-vulkan-drivers
 
-      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
         with:
+          toolchain: stable
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
 
-      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 89d3b647b1..0ebfaae45c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,6 +1,10 @@
 name: Release
 
 on:
+  # A nightly dry run on main: every release build except macOS, nothing signed or released
+  # (craft-common-actions release.yml `dry-run`). Finds release-only breakage before release day.
+  schedule:
+    - cron: "0 3 * * *"
   push:
     branches: [release]
   workflow_dispatch:
@@ -33,6 +37,7 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
+      dry-run: ${{ github.event_name == 'schedule' }}
       app-name: wordcraft
       app-title: WordCraft
       craft-fonts-ref: b076417b5880bd4154bd22f00695b1d28c6bea83
diff --git a/Cargo.lock b/Cargo.lock
index aa556b5b68..653ae11b75 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6807,7 +6807,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "arboard",
  "chrono",
@@ -6847,7 +6847,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-cli"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "image",
  "serde_json",
@@ -6863,11 +6863,11 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-control-key"
-version = "0.18.0"
+version = "0.18.1"
 
 [[package]]
 name = "wordcraft-doc"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "base64 0.23.1",
  "log",
@@ -6881,7 +6881,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docbin"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "cfb",
  "chrono",
@@ -6898,7 +6898,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-docx"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "aes",
  "base64 0.23.1",
@@ -6923,7 +6923,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-engine"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "cfb",
  "chrono",
@@ -6957,7 +6957,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-fonts"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "brotli-decompressor",
  "harfrust 0.13.3",
@@ -6971,7 +6971,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-formats"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "aes",
  "base64 0.23.1",
@@ -6998,7 +6998,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-geom"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "image",
  "serde",
@@ -7006,7 +7006,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-layout"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-proof",
  "image",
@@ -7026,7 +7026,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-mcp"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "log",
  "serde_json",
@@ -7038,7 +7038,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-metafile"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "kurbo",
  "thiserror 2.0.21",
@@ -7046,7 +7046,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-pdf"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "chrono",
  "craft-pdf",
@@ -7067,7 +7067,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-render"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "image",
  "log",
@@ -7081,7 +7081,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-ui-egui"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "accesskit_consumer",
  "cfb",
@@ -7114,7 +7114,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-web"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "craft-web-api",
  "craft-web-host",
@@ -7135,7 +7135,7 @@ dependencies = [
 
 [[package]]
 name = "wordcraft-zotero"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "log",
  "proptest",
@@ -7298,7 +7298,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
 
 [[package]]
 name = "xtask"
-version = "0.18.0"
+version = "0.18.1"
 dependencies = [
  "serde_json",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 209e45cf70..f6fa8c1f35 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/wordcraft", "apps/wordcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.18.0"
+version = "0.18.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
diff --git a/crates/ui-egui/tests/flatpak_updates.rs b/crates/ui-egui/tests/flatpak_updates.rs
new file mode 100644
index 0000000000..bc0cf42d6a
--- /dev/null
+++ b/crates/ui-egui/tests/flatpak_updates.rs
@@ -0,0 +1,27 @@
+//! Release and source Flatpaks must allow release checks and host update helpers.
+fn finish_args(manifest: &str) -> Vec<&str> {
+    manifest
+        .split("finish-args:")
+        .nth(1)
+        .unwrap_or_default()
+        .lines()
+        .take_while(|line| line.is_empty() || line.starts_with(' ') || line.starts_with('#'))
+        .filter_map(|line| line.trim().strip_prefix("- "))
+        .map(|arg| arg.trim_matches(['\'', '"']))
+        .collect()
+}
+
+#[test]
+fn flatpak_update_permissions() {
+    let manifests = [
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml"),
+        include_str!("../../../packaging/linux/flatpak/ai.storyteller.wordcraft.yml"),
+    ];
+    let args = manifests.map(finish_args);
+    assert_eq!(args[0], args[1], "source and release permissions must agree");
+    for permissions in args {
+        for required in ["--share=network", "--talk-name=org.freedesktop.Flatpak"] {
+            assert!(permissions.contains(&required), "missing update permission: {required}");
+        }
+    }
+}
diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml
index 694c7138ba..14d0a219a9 100644
--- a/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml
+++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.bundle.yml
@@ -17,6 +17,8 @@ runtime-version: '25.08'
 sdk: org.freedesktop.Sdk
 command: wordcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland
diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
index 9ce3934aef..a855e0c110 100644
--- a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
+++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
@@ -18,6 +18,8 @@ sdk-extensions:
   - org.freedesktop.Sdk.Extension.rust-stable
 command: wordcraft
 finish-args:
+  # The shared updater inspects and updates this installation via flatpak-spawn --host.
+  - --talk-name=org.freedesktop.Flatpak
   - --filesystem=xdg-data/ArtCraft/versions:ro
   # Display: Wayland first; X11 only when no Wayland compositor is running.
   - --socket=wayland