diff --git a/crates/pf-console-ui/Cargo.toml b/crates/pf-console-ui/Cargo.toml
index 284271e8..90c34198 100644
--- a/crates/pf-console-ui/Cargo.toml
+++ b/crates/pf-console-ui/Cargo.toml
@@ -33,6 +33,12 @@ pf-client-core = { path = "../pf-client-core", default-features = false }
 # pdf; 0.99: + jpeg). We take defaults, so the JPEG codecs came along with the bump. That is a
 # feature here rather than bloat: `screens/library.rs` feeds host poster art straight to
 # `Image::from_encoded`, which silently returned `None` for JPEG posters before.
+#
+# 🛑 BUMPING THIS LINE IS ONLY HALF THE BUMP. packaging/flatpak/io.unom.Punktfunk.yml pins the
+# archive above by URL + sha256 BY HAND (the offline sandbox can't fetch it) and nothing derives
+# that pin from this file. Leave it stale and the flatpak leg unpacks the OLD archive's
+# pre-generated bindings.rs under the NEW crate, failing with `no variant, associated function,
+# or constant named 'Default' found for enum SkPathFillType`. That is exactly how #193 shipped.
 skia-safe = { version = "0.99", features = ["vulkan", "textlayout"] }
 ash = { version = "0.38", features = ["loaded"] }
 
diff --git a/packaging/flatpak/README.md b/packaging/flatpak/README.md
index 2a63d7e5..d8ab421e 100644
--- a/packaging/flatpak/README.md
+++ b/packaging/flatpak/README.md
@@ -138,8 +138,10 @@ are now expressed properly rather than hardcoded:
 * **The prebuilt Skia archive** is per-target and pinned by sha256. There are now two `type: file`
   sources discriminated by `only-arches`, both landing on the same `dest-filename`, so
   `SKIA_BINARIES_URL` stays one literal path. Upstream publishes the aarch64 archive under the
-  same skia commit hash and the same resolved-feature key (`pdf-textlayout-vulkan`), so on a
-  skia-safe bump update both URLs and both hashes together.
+  same skia commit hash and the same resolved-feature key (at 0.99:
+  `jpegd-jpege-pdf-textlayout-vulkan`), so on a skia-safe bump update both URLs and both hashes
+  together. The feature key is **not** stable across bumps — 0.87 was `pdf-textlayout-vulkan`;
+  `jpeg` entering skia-safe's defaults at 0.99 renamed it.
 
 ```sh
 ARCH=aarch64 bash packaging/flatpak/build-flatpak.sh
@@ -179,8 +181,16 @@ build host that lacks those (the Deck), rsync the generated file in alongside th
 downloads prebuilt `libskia` binaries at build time, which is dead in the offline sandbox — so the
 manifest pins a `skia-binaries-….tar.gz` source and points the build at it with
 `SKIA_BINARIES_URL: file://…`. When bumping the `skia-safe`/`skia-bindings` crate version, update
-that pinned tarball (URL + sha256) to the matching `skia-binaries` release or the build breaks
-offline.
+that pinned tarball (URL + sha256) to the matching `skia-binaries` release **in the same commit**,
+or the build breaks offline.
+
+The failure is not a download error, because `file://` always succeeds — skia-bindings unpacks the
+stale archive verbatim, *including the `bindings.rs` it was generated with*, so the new crate's
+`src/defaults.rs` compiles against old bindings and the leg dies on missing associated consts
+(`SkPathFillType::Default`, `SkPathDirection::Default` — they live in the generated `bindings.rs`,
+so they travel with the archive, not the crate). Everything else in the offline chain is derived
+from `Cargo.lock` and self-corrects; this tarball is the only hand-maintained pin, and the
+0.87 → 0.99 bump (#193) left it behind.
 
 ## Hosting the repo (unom-1) + one-time setup
 
diff --git a/packaging/flatpak/io.unom.Punktfunk.yml b/packaging/flatpak/io.unom.Punktfunk.yml
index 816f7a94..2b5f005b 100644
--- a/packaging/flatpak/io.unom.Punktfunk.yml
+++ b/packaging/flatpak/io.unom.Punktfunk.yml
@@ -369,7 +369,7 @@ modules:
         path: ../..
       # Generated offline crate cache (see the comment block above). Remove for --share=network.
       - cargo-sources.json
-      # Prebuilt Skia for skia-bindings 0.87.0 (SKIA_BINARIES_URL above). The key encodes the
+      # Prebuilt Skia for skia-bindings 0.99.0 (SKIA_BINARIES_URL above). The key encodes the
       # crate's pinned skia commit + target + resolved features — when bumping skia-safe, build
       # the workspace once locally and take the new name from
       # target/release/build/skia-bindings-*/out/.cache/, then update url + sha256 together.
@@ -378,13 +378,24 @@ modules:
       # release publishes the aarch64 archive under the same skia commit hash and the same
       # resolved-feature key, so the two stay in lockstep on a skia-safe bump — take both new
       # names and sha256s together.
+      #
+      # ⚠ This pin MUST be bumped in the same commit as the skia-safe version in
+      # crates/pf-console-ui/Cargo.toml. `SKIA_BINARIES_URL: file://…` makes skia-bindings
+      # unpack this archive verbatim — INCLUDING its pre-generated bindings.rs — into
+      # target/…/build/skia-bindings-*/out/skia/. A stale archive therefore compiles the NEW
+      # crate's src/defaults.rs against the OLD bindings, and the flatpak leg dies with
+      # `no variant, associated function, or constant named 'Default' found for enum
+      # SkPathFillType` (that const is generated INTO bindings.rs, so it moves with the
+      # archive, not with the crate). Cargo.lock and cargo-sources.json are regenerated
+      # automatically; this file is the one place the skia archive is pinned by hand, which
+      # is exactly how the 0.87 → 0.99 bump (#193) left it behind.
       - type: file
         only-arches: [x86_64]
-        url: https://github.com/rust-skia/skia-binaries/releases/download/0.87.0/skia-binaries-e551f334ad5cbdf43abf-x86_64-unknown-linux-gnu-pdf-textlayout-vulkan.tar.gz
-        sha256: b46e7061e6b9df792025acaf9b8b90180224c7cec63f4c3ce09af7ddddb8abfa
+        url: https://github.com/rust-skia/skia-binaries/releases/download/0.99.0/skia-binaries-a25a0fdb7d90429aa2d1-x86_64-unknown-linux-gnu-jpegd-jpege-pdf-textlayout-vulkan.tar.gz
+        sha256: 158407a4b5ce8738431bb76498be3a44fda770e51d61aac18a0e0e97becdc1de
         dest-filename: skia-binaries.tar.gz
       - type: file
         only-arches: [aarch64]
-        url: https://github.com/rust-skia/skia-binaries/releases/download/0.87.0/skia-binaries-e551f334ad5cbdf43abf-aarch64-unknown-linux-gnu-pdf-textlayout-vulkan.tar.gz
-        sha256: 6994fb993064d7d4fff00bf7c79544ffc881bb5441b6768b31cc088540f4bef7
+        url: https://github.com/rust-skia/skia-binaries/releases/download/0.99.0/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-textlayout-vulkan.tar.gz
+        sha256: cf5469d1d963f704cc997f9b3342d11c49b917002361947e5c7bf7dcc3f13534
         dest-filename: skia-binaries.tar.gz