diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5edffc..2912a72 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,9 +15,7 @@ jobs:
       - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
-      # Not --strict: the seed legitimately carries flex-require, which the
-      # strict publish schema rejects; the real oracle is create-project below.
-      - run: composer validate --no-check-publish
+      - run: composer validate --strict
       - name: create-project end to end
         run: |
           cd "$RUNNER_TEMP"
diff --git a/composer.json b/composer.json
index 399e7ba..6ba287a 100644
--- a/composer.json
+++ b/composer.json
@@ -18,17 +18,15 @@
     "minimum-stability": "stable",
     "prefer-stable": true,
     "require": {
-        "php": ">=8.4",
         "ext-ctype": "*",
         "ext-iconv": "*",
-        "symfony/flex": "^2"
-    },
-    "flex-require": {
-        "symfony/console": "*",
-        "symfony/dotenv": "*",
-        "symfony/framework-bundle": "*",
-        "symfony/runtime": "*",
-        "symfony/yaml": "*"
+        "php": ">=8.4",
+        "symfony/console": "8.1.*",
+        "symfony/dotenv": "8.1.*",
+        "symfony/flex": "^2",
+        "symfony/framework-bundle": "8.1.*",
+        "symfony/runtime": "8.1.*",
+        "symfony/yaml": "8.1.*"
     },
     "require-dev": {},
     "config": {