diff --git a/apps/journal/app/lib/federation.server.ts b/apps/journal/app/lib/federation.server.ts
index 8622653..530e5d0 100644
--- a/apps/journal/app/lib/federation.server.ts
+++ b/apps/journal/app/lib/federation.server.ts
@@ -1,9 +1,10 @@
 // ActivityPub federation via Fedify. See openspec/changes/social-federation.
 //
-// Version pinning (task 1.2): @fedify/fedify is pinned to exactly 2.1.16.
-// The whole 2.2.x line is uninstallable from npm — each release depends on
-// @fedify/webfinger@2.2.x, which was never published (latest is 2.1.16).
-// Revisit the pin once `pnpm view @fedify/fedify dependencies` resolves.
+// Version pinning (task 1.2): @fedify/fedify is pinned exactly (no caret).
+// History: 2.2.x was briefly uninstallable from npm (its @fedify/webfinger
+// dependency wasn't published) — fixed upstream; upgraded to 2.2.5 on
+// 2026-06-07. The exact pin stays deliberate: a federation library defines
+// the wire shapes remote instances see, so upgrades should be conscious.
 //
 // Mounting model: Fedify owns URL dispatch for its endpoints via
 // `federation.fetch(request)`. We delegate to it from React Router routes:
diff --git a/apps/journal/package.json b/apps/journal/package.json
index 1ad1555..f0aafad 100644
--- a/apps/journal/package.json
+++ b/apps/journal/package.json
@@ -12,7 +12,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@fedify/fedify": "2.1.16",
+    "@fedify/fedify": "2.2.5",
     "@js-temporal/polyfill": "^0.5.1",
     "@logtape/logtape": "^2.0.5",
     "@react-router/node": "catalog:",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4f28e71..5dab3da 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -204,8 +204,8 @@ importers:
   apps/journal:
     dependencies:
       '@fedify/fedify':
-        specifier: 2.1.16
-        version: 2.1.16
+        specifier: 2.2.5
+        version: 2.2.5
       '@js-temporal/polyfill':
         specifier: ^0.5.1
         version: 0.5.1
@@ -2129,24 +2129,24 @@ packages:
     resolution: {integrity: sha512-4aQzz9vgxcNXFfo/iyNgDDYfsU5XGKKxWxZopw0cVotHiW+U8IJbIxMaxsINs6bHhtkG3StKNPcOrn3eBuxKPw==}
     hasBin: true
 
-  '@fedify/fedify@2.1.16':
-    resolution: {integrity: sha512-zBuNLjx7jqg/Dig19IUkUI91UL1JC9M3GWYJOG1cq0RFUkfh/soqiY0UBNhFJGEXyEqI+QIGS976NDZzb9t/ZA==}
+  '@fedify/fedify@2.2.5':
+    resolution: {integrity: sha512-nARV2R/lkPgUb7XBZkg+MjmZUr0vkoEWG2w/+7Rle7uf2jgk8bL3axxl95xUkvf7gWwqHrBXgw9RXWReMFIFaw==}
     engines: {bun: '>=1.1.0', deno: '>=2.0.0', node: '>=22.0.0'}
 
-  '@fedify/vocab-runtime@2.1.16':
-    resolution: {integrity: sha512-1I+x1I+AZmQo956SQXPlGWiMjQNdOGgN0o8bBMCQO4pOgudKCiX9JQjVvfSDyr+3MwAJnC3ay6yuY74gRhhGxw==}
+  '@fedify/vocab-runtime@2.2.5':
+    resolution: {integrity: sha512-EiPkMwBqYsoSrllMOCFb0RTDwEO6XvppMmPa81lCux+7g9zXygKrJb9hJ9PP8Zi59+cJGqIF/Gdhug239+tZug==}
     engines: {bun: '>=1.1.0', deno: '>=2.0.0', node: '>=22.0.0'}
 
-  '@fedify/vocab-tools@2.1.16':
-    resolution: {integrity: sha512-MZSJHPOr6hzTtYJUm1r1PBjFBqhLEuNLoJYrC7yj7JiZQwmWYcjbwOYCxeljnQ2SNt52WOqVXV7AFCbofuRNXA==}
+  '@fedify/vocab-tools@2.2.5':
+    resolution: {integrity: sha512-D5GMXvcoSeNhI68BBPlpLHAlI7dqc0pheqj3NDCp9f5bBagXz7o+oevzzjZFxiHgxYQfRVoZ2N5lFNEy5d27gQ==}
     engines: {bun: '>=1.1.0', deno: '>=2.0.0', node: '>=22.0.0'}
 
-  '@fedify/vocab@2.1.16':
-    resolution: {integrity: sha512-bVe07C6AFtyMqiqJzB9TO7IR9L6l2gA2ZeOqw5f0/d28jJSahsr0ZnmWi+ckf1/YpPq1Yl6uMx37m/udW8wwUA==}
+  '@fedify/vocab@2.2.5':
+    resolution: {integrity: sha512-68CYYd239zgfcVppUZGA7D90y0gEcAXNzSxUOBLy04XUZG6MUO81xk5k/j4l9Twagf1KtfQI/gwPpldfpBJeQQ==}
     engines: {bun: '>=1.1.0', deno: '>=2.0.0', node: '>=22.0.0'}
 
-  '@fedify/webfinger@2.1.16':
-    resolution: {integrity: sha512-QVq8sFd0xVg4r2IySeoX7H2HnUwdiGkHyTrOT8G+5qu8/5nqVEP/ufcoM2HSU8zNElCjR+M4yjlOMUiW7hTkWg==}
+  '@fedify/webfinger@2.2.5':
+    resolution: {integrity: sha512-NHJ0Q+YXbkE3mmQZhf5/UccSTOVUwtOCm9bQmFKGd8BbY5HCnjMceVZqLlCLT4AC6d7o5j9717KPl7+B2b7XvA==}
     engines: {bun: '>=1.1.0', deno: '>=2.0.0', node: '>=22.0.0'}
 
   '@fission-ai/openspec@1.3.1':
@@ -10211,11 +10211,11 @@ snapshots:
       chalk: 4.1.2
       js-yaml: 4.1.1
 
-  '@fedify/fedify@2.1.16':
+  '@fedify/fedify@2.2.5':
     dependencies:
-      '@fedify/vocab': 2.1.16
-      '@fedify/vocab-runtime': 2.1.16
-      '@fedify/webfinger': 2.1.16
+      '@fedify/vocab': 2.2.5
+      '@fedify/vocab-runtime': 2.2.5
+      '@fedify/webfinger': 2.2.5
       '@js-temporal/polyfill': 0.5.1
       '@logtape/logtape': 2.1.1
       '@opentelemetry/api': 1.9.1
@@ -10231,7 +10231,7 @@ snapshots:
       url-template: 3.1.1
       urlpattern-polyfill: 10.1.0
 
-  '@fedify/vocab-runtime@2.1.16':
+  '@fedify/vocab-runtime@2.2.5':
     dependencies:
       '@js-temporal/polyfill': 0.5.1
       '@logtape/logtape': 2.1.1
@@ -10242,18 +10242,18 @@ snapshots:
       jsonld: 9.0.0
       pkijs: 3.4.0
 
-  '@fedify/vocab-tools@2.1.16':
+  '@fedify/vocab-tools@2.2.5':
     dependencies:
       '@cfworker/json-schema': 4.1.1
       byte-encodings: 1.0.11
       es-toolkit: 1.43.0
       yaml: 2.9.0
 
-  '@fedify/vocab@2.1.16':
+  '@fedify/vocab@2.2.5':
     dependencies:
-      '@fedify/vocab-runtime': 2.1.16
-      '@fedify/vocab-tools': 2.1.16
-      '@fedify/webfinger': 2.1.16
+      '@fedify/vocab-runtime': 2.2.5
+      '@fedify/vocab-tools': 2.2.5
+      '@fedify/webfinger': 2.2.5
       '@js-temporal/polyfill': 0.5.1
       '@logtape/logtape': 2.1.1
       '@multiformats/base-x': 4.0.1
@@ -10263,9 +10263,9 @@ snapshots:
       jsonld: 9.0.0
       pkijs: 3.4.0
 
-  '@fedify/webfinger@2.1.16':
+  '@fedify/webfinger@2.2.5':
     dependencies:
-      '@fedify/vocab-runtime': 2.1.16
+      '@fedify/vocab-runtime': 2.2.5
       '@logtape/logtape': 2.1.1
       '@opentelemetry/api': 1.9.1
       es-toolkit: 1.43.0