diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e81af69..9360b97b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Clean-room check
         shell: pwsh
@@ -164,7 +166,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Install Native AOT prerequisites
         if: runner.os == 'Linux'
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 3e59c914..aa313e3a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -38,7 +38,7 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
 
       - name: Install DocFX
         run: dotnet tool update -g docfx
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e944d47..4c1513c8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Derive version from tag
         id: version
@@ -121,7 +123,9 @@ jobs:
 
       - uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
+
+      - run: dotnet --version
 
       - name: Derive version from tag
         id: version
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4ddea80..2e991691 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -209,6 +209,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   every assembly, and all eleven symbol PDBs with their SourceLink document maps are byte-identical,
   so nothing that ships changes. The package's own MSBuild logic is byte-identical to the SDK's copy;
   only the compiled task assembly now floats with the SDK band instead of being pinned. (#202)
+- **`global.json` now pins the SDK feature band the workflows resolve, instead of trailing it.**
+  It named `10.0.204` with `latestFeature`, while every `actions/setup-dotnet` step asked for
+  `10.0.x` and landed on whatever band was newest at the time — `10.0.400` as of this change. With
+  `TreatWarningsAsErrors` and `AnalysisLevel latest`, a diagnostic new to that band is a CI failure
+  a developer on the older SDK cannot reproduce. `global.json` now reads `10.0.400` with
+  `latestPatch`, and all five `setup-dotnet` steps (`ci.yml` build and AOT smoke jobs, `release.yml`
+  library and tool jobs, `docs.yml`) point at `global-json-file: global.json` rather than repeating
+  the version inline, so the two can no longer drift apart. (#231)
 
 ### Fixed
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 955d2468..e0168d69 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,7 +5,11 @@ build, test, and submit changes to VellumPdf.
 
 ## Prerequisites
 
-- **.NET 10 SDK** (the only required runtime dependency).
+- **.NET 10 SDK**, feature band 10.0.4xx — the exact pin is in `global.json`;
+  earlier feature bands are rejected.
+- Before tagging a release: merge and CI-validate any `global.json`
+  feature-band bump first. `release.yml` reads `global.json` from the tag's
+  tree, so a stale pin ships a release built on a superseded SDK band.
 - **Docker** — needed to run the veraPDF conformance gate locally.
 - **qpdf** and **poppler-utils** — needed to run the structural-validator,
   text-extraction, signature, and barcode-rasterization oracle tests locally
diff --git a/global.json b/global.json
index 7270173c..07023180 100644
--- a/global.json
+++ b/global.json
@@ -1,6 +1,8 @@
 {
   "sdk": {
-    "version": "10.0.204",
-    "rollForward": "latestFeature"
+    "version": "10.0.400",
+    // Required for CI to pick up 10.0.4xx patch releases; removing it pins CI to
+    // exactly 10.0.400 and drops patch servicing.
+    "rollForward": "latestPatch"
   }
 }