diff --git a/Cargo.lock b/Cargo.lock
index d4e6da0..ea0386d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1314,7 +1314,7 @@ dependencies = [
 
 [[package]]
 name = "tinybus"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "async-trait",
  "flate2",
@@ -1337,7 +1337,7 @@ dependencies = [
 
 [[package]]
 name = "tinybus-macros"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1346,7 +1346,7 @@ dependencies = [
 
 [[package]]
 name = "tinybus-module"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "async-trait",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index c9c8893..76228a8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,13 +34,13 @@ tinysearch-bus = { path = "crates/tinysearch-bus" }
 # TinyBus defines the message types, interface macro, and frozen module ABI
 # used by the generated integration. Socket and CLI features are unnecessary
 # here.
-tinybus = { version = ">=0.3.2, <0.4", default-features = false, features = [
+tinybus = { version = ">=0.3.3, <0.4", default-features = false, features = [
     "macros",
     "modules",
 ] }
 # The module-side SDK owns the isolated runtime and exports the ABI entrypoints
 # required by TinyBus's dynamic loader.
-tinybus-module = { version = ">=0.3.2, <0.4" }
+tinybus-module = { version = ">=0.3.3, <0.4" }
 # Derive macros for the crate-wide error type in `crates/tinysearch/src/error/`.
 # Every dependency entry should carry a comment like this one saying why it is
 # here.
diff --git a/scripts/test-e2e-version.py b/scripts/test-e2e-version.py
index 7cb5948..8342acc 100644
--- a/scripts/test-e2e-version.py
+++ b/scripts/test-e2e-version.py
@@ -70,7 +70,7 @@ def test_distro_powershell_forwards_arguments_and_exit_status(self):
                 "--crate",
                 "tinysearch",
                 "--version",
-                "0.5.1",
+                "0.5.2",
             ]
             try:
                 result = subprocess.run(
@@ -127,7 +127,7 @@ def test_distro_powershell_rejects_unsupported_image_before_docker(self):
                     "--crate",
                     "tinysearch",
                     "--version",
-                    "0.5.1",
+                    "0.5.2",
                     "--target",
                     "x86_64-unknown-linux-gnu",
                     "--host",
diff --git a/scripts/test-release-workflow.py b/scripts/test-release-workflow.py
index e51ab7b..be4c18d 100644
--- a/scripts/test-release-workflow.py
+++ b/scripts/test-release-workflow.py
@@ -14,7 +14,19 @@
 CI_WORKFLOW = ROOT / ".github/workflows/ci.yml"
 REVIEWED_RELEASE_SHA = "6ed83b04aab2d8977ec62e966cb914531e534fa4"
 ORDINARY_RELEASE_SHA = "4adc1080fb495098e7af1aade82ed7e6e3c69bb7"
-TINYBUS_SDK_SHA = "cba2de0e573f99fe4c7e45ba14e2d6b5a2a7757f"
+TINYBUS_SDK_SHA = "207a9a7df15e44fdba00a807d0f7eaf21904ba0e"
+
+
+def has_expected_sdk_gitlink(entry, expected_sha):
+    """Match the SDK pin from the parent Git tree, even without checkout."""
+    fields = entry.split()
+    return (
+        len(fields) == 4
+        and fields[0] == "160000"
+        and fields[1] == "commit"
+        and fields[2] == expected_sha
+        and fields[3] == "vendor/tinybus"
+    )
 
 
 def resolve_script(workflow):
@@ -91,19 +103,32 @@ def test_published_candidate_and_sdk_constraints_match_released_compatibility(se
         self.assertEqual(manifest["workspace"]["package"]["version"], "0.5.2")
         self.assertEqual(
             manifest["workspace"]["dependencies"]["tinybus"]["version"],
-            ">=0.3.2, <0.4",
+            ">=0.3.3, <0.4",
         )
         self.assertEqual(
             manifest["workspace"]["dependencies"]["tinybus-module"]["version"],
-            ">=0.3.2, <0.4",
+            ">=0.3.3, <0.4",
         )
-        bus_head = subprocess.run(
-            ["git", "-C", str(ROOT / "vendor/tinybus"), "rev-parse", "HEAD"],
+        sdk_gitlink = subprocess.run(
+            ["git", "-C", str(ROOT), "ls-tree", "HEAD", "vendor/tinybus"],
             check=True,
             text=True,
             capture_output=True,
-        ).stdout.strip()
-        self.assertEqual(bus_head, TINYBUS_SDK_SHA)
+        ).stdout
+        self.assertTrue(has_expected_sdk_gitlink(sdk_gitlink, TINYBUS_SDK_SHA))
+
+    def test_sdk_gitlink_guard_accepts_exact_and_rejects_stale_or_missing_pins(self):
+        exact = f"160000 commit {TINYBUS_SDK_SHA}\tvendor/tinybus"
+        stale = "160000 commit cba2de0e573f99fe4c7e45ba14e2d6b5a2a7757f\tvendor/tinybus"
+
+        self.assertTrue(has_expected_sdk_gitlink(exact, TINYBUS_SDK_SHA))
+        self.assertFalse(has_expected_sdk_gitlink(stale, TINYBUS_SDK_SHA))
+        self.assertFalse(has_expected_sdk_gitlink("", TINYBUS_SDK_SHA))
+        self.assertFalse(
+            has_expected_sdk_gitlink(
+                f"100644 blob {TINYBUS_SDK_SHA}\tvendor/tinybus", TINYBUS_SDK_SHA
+            )
+        )
 
     def test_reviewed_release_requires_positive_pr_on_main_and_uses_fixed_profile(self):
         result, output = self.run_resolve("reviewed-epic", "83")
diff --git a/vendor/tinybus b/vendor/tinybus
index cba2de0..207a9a7 160000
--- a/vendor/tinybus
+++ b/vendor/tinybus
@@ -1 +1 @@
-Subproject commit cba2de0e573f99fe4c7e45ba14e2d6b5a2a7757f
+Subproject commit 207a9a7df15e44fdba00a807d0f7eaf21904ba0e