diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index f2bb900..50246ec 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -1,7 +1,7 @@
 {
   "name": "holocron",
   "description": "AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "owner": {
     "name": "Defame1297",
     "email": "defame1297@rkdr.net",
@@ -18,7 +18,7 @@
     {
       "name": "bin",
       "description": "A place for things to be binned",
-      "version": "1.1.2",
+      "version": "1.1.3",
       "category": "Utilities",
       "source": "./plugins/bin"
     },
diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json
index f2bb900..50246ec 100644
--- a/.github/plugin/marketplace.json
+++ b/.github/plugin/marketplace.json
@@ -1,7 +1,7 @@
 {
   "name": "holocron",
   "description": "AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "owner": {
     "name": "Defame1297",
     "email": "defame1297@rkdr.net",
@@ -18,7 +18,7 @@
     {
       "name": "bin",
       "description": "A place for things to be binned",
-      "version": "1.1.2",
+      "version": "1.1.3",
       "category": "Utilities",
       "source": "./plugins/bin"
     },
diff --git a/.gitignore b/.gitignore
index a4019b1..0a023db 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,11 @@ apm_modules/
 # `apm pack` bundle output. The pre-push gate runs pack with --dry-run, so this
 # only appears after a bare `apm pack` during a release; it is not repo content.
 build/
+
+# `apm pack`'s manifest for the *root* package. Emitted beside the marketplace
+# manifest by a bare `apm pack`, and never tracked on any branch — the repo's
+# own paths hide it, since sync-plugin-content.sh redirects `apm pack -o` to a
+# scratch tree and the apm-pack-check-clean pre-push hook runs --dry-run. Scoped
+# to the file, not the directory: the sibling .claude-plugin/marketplace.json is
+# compiled output that IS committed and must stay tracked.
+/.claude-plugin/plugin.json
diff --git a/.mcp.json b/.mcp.json
index a1e4c58..7aa9712 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -2,7 +2,7 @@
   "mcpServers": {
     "obsidian": {
       "args": [
-        "@bitbonsai/mcpvault@latest",
+        "@bitbonsai/mcpvault@0.15.0",
         "docs/"
       ],
       "command": "npx",
diff --git a/apm.yml b/apm.yml
index 85cbcc3..bfaa15a 100644
--- a/apm.yml
+++ b/apm.yml
@@ -1,5 +1,5 @@
 name: holocron
-version: 0.4.0
+version: 0.4.1
 description: AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
 license: MIT
 
@@ -52,7 +52,7 @@ marketplace:
   # top-level apm.yml description:/version: above are NOT inherited into the
   # compiled output despite being used elsewhere (e.g. by `apm audit`).
   description: AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
-  version: 0.4.0
+  version: 0.4.1
   owner:
     name: Defame1297
     email: defame1297@rkdr.net
@@ -85,7 +85,7 @@ marketplace:
     - name: bin
       description: A place for things to be binned
       source: ./plugins/bin
-      version: 1.1.2
+      version: 1.1.3
       category: Utilities
 
     - name: git
diff --git a/plugins/bin/.claude-plugin/plugin.json b/plugins/bin/.claude-plugin/plugin.json
index 18e4804..7e40868 100644
--- a/plugins/bin/.claude-plugin/plugin.json
+++ b/plugins/bin/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "bin",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "A place for things to be binned",
   "author": {
     "name": "Defame1297",
@@ -20,7 +20,7 @@
   "mcpServers": {
     "obsidian": {
       "args": [
-        "@bitbonsai/mcpvault@latest",
+        "@bitbonsai/mcpvault@0.15.0",
         "docs/"
       ],
       "command": "npx",
diff --git a/plugins/bin/.github/plugin/plugin.json b/plugins/bin/.github/plugin/plugin.json
index 74e5109..c43b71d 100644
--- a/plugins/bin/.github/plugin/plugin.json
+++ b/plugins/bin/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "bin",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "A place for things to be binned",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/bin/.mcp.json b/plugins/bin/.mcp.json
index a1e4c58..7aa9712 100644
--- a/plugins/bin/.mcp.json
+++ b/plugins/bin/.mcp.json
@@ -2,7 +2,7 @@
   "mcpServers": {
     "obsidian": {
       "args": [
-        "@bitbonsai/mcpvault@latest",
+        "@bitbonsai/mcpvault@0.15.0",
         "docs/"
       ],
       "command": "npx",
diff --git a/plugins/bin/README.md b/plugins/bin/README.md
index 4ba6fd9..ec49fea 100644
--- a/plugins/bin/README.md
+++ b/plugins/bin/README.md
@@ -33,7 +33,7 @@ copilot plugin install ./plugins/bin
 | Component | Path | Description |
 |---|---|---|
 | Skills | `.apm/skills/` → `skills/` | Slash commands available after install |
-| MCP servers | `.mcp.json` | The `obsidian` server (`npx @bitbonsai/mcpvault@latest docs/`), hand-authored at the plugin root |
+| MCP servers | `.mcp.json` | The `obsidian` server (`npx @bitbonsai/mcpvault@0.15.0 docs/`), hand-authored at the plugin root |
 
 `.apm/` is the authoring source; `skills/` is the generated mirror plugin hosts scan (ADR-0017). This plugin ships no agents. It is the only plugin here with a non-empty `.mcp.json`, which is why its compiled manifests are the only ones carrying an `mcpServers` block.
 
diff --git a/plugins/bin/apm.yml b/plugins/bin/apm.yml
index 8499010..f9c8e65 100644
--- a/plugins/bin/apm.yml
+++ b/plugins/bin/apm.yml
@@ -1,5 +1,5 @@
 name: bin
-version: 1.1.2
+version: 1.1.3
 description: A place for things to be binned
 author:
   name: Defame1297