diff --git a/.github/workflows/release-bump-version.yml b/.github/workflows/release-bump-version.yml
index 4e4f26abcf..3eee5055fc 100644
--- a/.github/workflows/release-bump-version.yml
+++ b/.github/workflows/release-bump-version.yml
@@ -261,6 +261,31 @@ jobs:
           fi
           bump2version $CONFIG_FLAG ${{ inputs.bump_type }}
 
+      - name: Sync Cargo.lock into the cua-driver-rs bump commit
+        # bump2version edits only `[workspace.package] version` in Cargo.toml,
+        # leaving Cargo.lock's workspace-member versions stale. The next plain
+        # `cargo build` anyone runs then re-locks them and diverges from the
+        # committed lockfile — which used to break the nix build's cargoHash.
+        # Re-lock the members now and fold the change into the bump commit so the
+        # lockfile never ships out of sync with the manifest. (cargo is
+        # preinstalled on ubuntu runners; `--workspace` touches members only, not
+        # registry deps, so this never silently bumps dependencies.)
+        if: ${{ inputs.service == 'cua-driver-rs' }}
+        run: |
+          cd ${{ steps.package.outputs.directory }}
+          cargo update --workspace
+          if ! git diff --quiet Cargo.lock; then
+            TAG=$(git tag --points-at HEAD | head -1)
+            git add Cargo.lock
+            git commit --amend --no-edit
+            # bump2version tagged the pre-amend commit; move the tag onto the
+            # amended commit so the release pipeline builds the synced lockfile.
+            [ -n "$TAG" ] && git tag -f "$TAG" HEAD
+            echo "Re-locked Cargo.lock and moved tag ${TAG:-<none>} to the amended bump commit."
+          else
+            echo "Cargo.lock already in sync; nothing to fold in."
+          fi
+
       - name: Collect created tag
         id: collect_tags
         run: |
diff --git a/libs/cua-driver/rust/Cargo.lock b/libs/cua-driver/rust/Cargo.lock
index 5133676757..e9aed8b7cb 100644
--- a/libs/cua-driver/rust/Cargo.lock
+++ b/libs/cua-driver/rust/Cargo.lock
@@ -486,7 +486,7 @@ dependencies = [
 
 [[package]]
 name = "cua-driver"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -517,7 +517,7 @@ dependencies = [
 
 [[package]]
 name = "cua-driver-core"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -532,7 +532,7 @@ dependencies = [
 
 [[package]]
 name = "cua-driver-uia"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "cua-driver-core",
@@ -547,7 +547,7 @@ dependencies = [
 
 [[package]]
 name = "cursor-overlay"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "image",
@@ -787,7 +787,7 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "focus-monitor-win"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "windows 0.58.0",
 ]
@@ -1591,7 +1591,7 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pip-preview"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -1617,7 +1617,7 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "platform-linux"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1644,7 +1644,7 @@ dependencies = [
 
 [[package]]
 name = "platform-macos"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1677,7 +1677,7 @@ dependencies = [
 
 [[package]]
 name = "platform-windows"
-version = "0.5.3"
+version = "0.5.6"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/nix/cua-driver/package.nix b/nix/cua-driver/package.nix
index e17317e415..30cb7e39f9 100644
--- a/nix/cua-driver/package.nix
+++ b/nix/cua-driver/package.nix
@@ -15,17 +15,24 @@
 
 pkgs.rustPlatform.buildRustPackage {
   pname = "cua-driver";
-  version = "0.5.3";
+  # Read the version from the single source of truth (the workspace manifest
+  # bumpversion edits) so it can never drift from Cargo.toml the way a
+  # hardcoded literal silently did across 0.5.3 -> 0.5.6.
+  version = (pkgs.lib.importTOML "${src}/Cargo.toml").workspace.package.version;
 
   inherit src;
 
-  # Use cargoHash (fetchCargoVendor) rather than cargoLock.lockFile because
-  # the workspace Cargo.lock includes macOS-only crates (apple-metal, apple-cf)
-  # that may be unreachable from crates.io. fetchCargoVendor handles this
-  # gracefully via `cargo vendor`.
-  # Bumped when the dependency set changes (added `atspi`/zbus for native
-  # AT-SPI). If this mismatches, the nix build prints the expected value.
-  cargoHash = "sha256-ykVW0duMeoWho0qwDdu0k//cOY6HG+HsIBQF7iT0nZ0=";
+  # Vendor straight from the committed Cargo.lock instead of a manual cargoHash.
+  # `importCargoLock` derives every dependency's fixed-output hash from the
+  # lockfile itself, so there is NO hash to hand-maintain: Cargo.lock can change
+  # (a version bump, a dependency update) and the build keeps working. The old
+  # cargoHash approach hashed the vendored lockfile, so any Cargo.lock change —
+  # even a workspace-version bump the release bump leaves behind — silently
+  # invalidated it and turned every nix job red until someone recomputed it.
+  # Every dependency here is a crates.io registry crate (the macOS-only
+  # apple-cf/apple-metal/objc2 crates included) and there are zero git deps, so
+  # importCargoLock needs no `outputHashes` overrides.
+  cargoLock.lockFile = "${src}/Cargo.lock";
 
   # Build only the main binary crate. The workspace also contains
   # platform-macos, platform-windows, cua-driver-uia, and focus-monitor-win