diff --git a/Package.resolved b/Package.resolved
index c9171ea..52ddc43 100644
--- a/Package.resolved
+++ b/Package.resolved
@@ -1,5 +1,5 @@
 {
-  "originHash" : "db3c947574c43b51cfcec47404ab0e2fecf5719c1cf103f1adaaa194bc8b77ca",
+  "originHash" : "7391faf16959639b2507781aa5b70a14e3d0ec1f39a6426476e50f099184d650",
   "pins" : [
     {
       "identity" : "cryptoswift",
@@ -24,7 +24,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/weichsel/ZIPFoundation",
       "state" : {
-        "revision" : "e7a17d57c583067eaa6659cd6d9521265b7664e9"
+        "revision" : "22787ffb59de99e5dc1fbfe80b19c97a904ad48d",
+        "version" : "0.9.20"
       }
     }
   ],
diff --git a/Package.swift b/Package.swift
index 12463f0..2fec995 100644
--- a/Package.swift
+++ b/Package.swift
@@ -25,8 +25,10 @@ let package = Package(
     ],
     dependencies: [
         .package(url: "https://github.com/krzyzanowskim/CryptoSwift", from: "1.10.0"),
-        // 0.9.20 still warns on watchOS(.v4); development includes the #388 manifest fix
-        .package(url: "https://github.com/weichsel/ZIPFoundation", revision: "e7a17d57c583067eaa6659cd6d9521265b7664e9"),
+        // A version requirement, not a revision: SwiftPM refuses a stable-version
+        // dependency on a package that pins a revision, so a revision here makes
+        // OpenTDFKit unresolvable for every consumer that requires it by version.
+        .package(url: "https://github.com/weichsel/ZIPFoundation", from: "0.9.20"),
         .package(url: "https://github.com/valpackett/SwiftCBOR", from: "0.6.0"),
     ],
     targets: [