diff --git a/iso/bread-lockfile.toml b/iso/bread-lockfile.toml
index 6adbf1e..ac34e31 100644
--- a/iso/bread-lockfile.toml
+++ b/iso/bread-lockfile.toml
@@ -3,7 +3,7 @@
 # build-local.sh and CI (scripts/ci-stage-bakery.py) read this file. A missing
 # *required* binary fails the bake: a hollow ISO is worse than a failed build.
 # optional_bins are baked when the verified stable index publishes them, and
-# skipped with a warning when it does not (today: bread 0.7.0 has no
+# skipped with a warning when it does not (today: bread 0.8.0 has no
 # bread-emit / bread-module-host).
 #
 # A flat `bins` list is still accepted and treated as required_bins.
@@ -47,21 +47,24 @@ optional_bins = [
   "bread-module-host",
 ]
 
-# Package name → version, matching today's stable index. CI prefers the
-# pinned version URL when a key is set. [[pin]] { package, version } is
-# accepted as well and merged (conflict = bake error).
+# Package name → version. Must exist at dl.breadway.dev/<pkg>/<ver>/ and
+# should match the signed index so CI can verify sha256. Newer git tags
+# that bakery release CI did not publish (breadpad 0.5.1, breadmon 0.1.3,
+# breadclip 0.2.2, breadshot 0.1.2, breadhelp 0.2.4, breadcrumbs 2.1.7)
+# stay off this list until those artifacts exist.
+# [[pin]] { package, version } is accepted as well and merged (conflict = bake error).
 [versions]
 bakery = "0.7.2"
 bread = "0.8.0"
 bread-theme = "0.7.2"
 breadbar = "0.3.1"
 breadbox = "0.3.1"
-breadcrumbs = "2.1.7"
-breadpad = "0.5.1"
+breadcrumbs = "2.1.6"
+breadpad = "0.5.0"
 breadpaper = "0.1.12"
-breadmon = "0.1.3"
+breadmon = "0.1.2"
 breadsearch = "0.3.1"
-breadclip = "0.2.2"
-breadshot = "0.1.2"
+breadclip = "0.1.1"
+breadshot = "0.1.1"
 bos-settings = "0.8.0"
-breadhelp = "0.2.4"
+breadhelp = "0.2.3"