diff --git a/bootloader/Cargo.lock b/bootloader/Cargo.lock
index ca2f5e69e3a..38d15ac36a8 100644
--- a/bootloader/Cargo.lock
+++ b/bootloader/Cargo.lock
@@ -14,9 +14,9 @@ checksum = "dc827186963e592360843fb5ba4b973e145841266c1357f7180c43526f2e5b61"
 
 [[package]]
 name = "bitflags"
-version = "2.4.2"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "block-buffer"
@@ -50,9 +50,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cpufeatures"
@@ -96,7 +96,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.48",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -148,21 +148,21 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.78"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2422ad645d89c99f8f3e6b88a9fdeca7fabeac836b1002371c4367c8f984aae"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
@@ -189,9 +189,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.35"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -247,9 +247,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.48"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f3531638e407dfc0814761abb7c00a5b54992b849452a0646b7f65c9f770f3f"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -349,7 +349,7 @@ checksum = "26a7b1c2c808c3db854a54d5215e3f7e7aaf5dcfbce095598cba6af29895695d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.48",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -382,9 +382,9 @@ checksum = "ab14ea9660d240e7865ce9d54ecdbd1cd9fa5802ae6f4512f093c7907e921533"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "version_check"
diff --git a/bootloader/Cargo.toml b/bootloader/Cargo.toml
index 336515d252b..7b4ca6d8b21 100644
--- a/bootloader/Cargo.toml
+++ b/bootloader/Cargo.toml
@@ -50,5 +50,6 @@ uefi-services = { version = "0.23.0", features = ["panic_handler", "logger"] }
 inherits = "dev"
 opt-level = 2
 debug = true
+strip = "debuginfo"
 debug-assertions = true
 overflow-checks = true
diff --git a/issues/the-tree-resolves-in-five-cargo-locks-not-one.md b/issues/the-tree-resolves-in-five-cargo-locks-not-one.md
index 51bfe9526e8..026923d1e69 100644
--- a/issues/the-tree-resolves-in-five-cargo-locks-not-one.md
+++ b/issues/the-tree-resolves-in-five-cargo-locks-not-one.md
@@ -7,13 +7,12 @@ opened: 2026-10-04
 # The tree resolves in five Cargo locks, not one
 
 The root, `kernel/`, `bootloader/`, `userland/` and `toyos/` are five
-Cargo resolutions with five locks, and four of them declare their own
+Cargo resolutions with five locks, and three of them declare their own
 `[profile.toyos]`. A
 crate two of them share is tested on the host against the root's lock and
-shipped from another's, and the locks disagree on versions: once the
-userland lock is aligned, 8 registry pairs sit below the highest version
-another of the five locks carries in the same semver range, all of them the
-loader's.
+shipped from another's. The locks agree on versions: no registry pair of the
+five sits below the highest version another of them carries in the same
+semver range.
 
 **The owner ruled on 2026-10-04.** Asked "Merge everything into one Cargo
 workspace (after small version-alignment steps; proven by byte-identical
@@ -33,9 +32,9 @@ byte-identical to the build of the last alignment before it. The root
 moves that instruction; no `rust-toolchain.toml` is tracked outside `rust/`,
 since step 1 of the rule in `issues/the-tree-says-who-uses-each-thing.md`
 names none. The alignments
-land first, each in today's workspace: pull request #724 aligned the root
-and kernel locks, the userland lock is the second, and the loader's 8 pairs
-are the last.
+landed first, each in today's workspace: pull request #724 aligned the root
+and kernel locks, #732 the userland lock, and the third the loader's lock and
+its profile's `strip`, so that the three `[profile.toyos]` tables are one.
 
 **Constraints, measured** on a scratch workspace seeded from the five locks
 at `8b4f88446`, by type-check and one loader link, with no boot:
@@ -46,8 +45,7 @@ at `8b4f88446`, by type-check and one loader link, with no boot:
   userland's moves pull with them (`ureq-proto`, `utf-8`, `zeroize_derive`),
   and the root's registry `getrandom` 0.2, 0.3 and 0.4, which become the forks
   userland patches in at the same versions. Those three move no version: they
-  follow from the root `[patch]` and land with it. What the loader's `libc`,
-  added since, pulls with it is not measured.
+  follow from the root `[patch]` and land with it.
 - `userland/Cargo.lock` carries `miniz_oxide` 0.8.9, for `png` 0.18.1,
   beside 0.9.1, for `flate2` 1.1.10. Built with only `flate2` back at 1.1.9,
   compositor and files are 204 to 228 bytes of text smaller on x86_64 and
@@ -57,9 +55,6 @@ at `8b4f88446`, by type-check and one loader link, with no boot:
 - Every fork commit the five locks pin stays pinned, and the crypto
   pre-releases (`ed25519-dalek 3.0.0-pre.6`, `pkcs5 0.8.0-rc.13`) are only in
   `userland/Cargo.lock` and stay.
-- The loader's `[profile.toyos]` has no `strip = "debuginfo"`; a loader built
-  with and without it differs in 247,720 of 328,192 bytes. One profile is a
-  loader byte change, made before the merge.
 - `[patch]` is workspace-wide. `tests/toyos-rust-tests` patches memmap2,
   `tests/toyos-rust-tests/tls-cranelift`, a resolution with its own lock,
   patches target-lexicon, and `tests/ssh-client-host` takes upstream tokio,