diff --git a/changelog b/changelog
index 729e7cd..104a4d1 100644
--- a/changelog
+++ b/changelog
@@ -3,7 +3,7 @@ turnkey-symfony-19.0 (1) turnkey; urgency=low
   * Rebase the appliance on Debian 13/Trixie.
 
   * Install the official Symfony 7.4 LTS skeleton and pin FrameworkBundle
-    v7.4.17 with verified source provenance.
+    v7.4.18 with verified source provenance.
 
   * Replace the vendor welcome patch with a small sample application that
     exercises framework routing and MariaDB through Doctrine DBAL.
diff --git a/conf.d/main b/conf.d/main
index 069b79c..1981689 100755
--- a/conf.d/main
+++ b/conf.d/main
@@ -7,8 +7,8 @@ WEBROOT=/var/www/symfony
 SKELETON_VERSION=7.4.99
 SKELETON_COMMIT=bf1abda299403468285fd4fa0514d916991c9120
 SKELETON_SHA256=9dae378ef8e120b2763dd4879c9bb6ecae44592b3be156f3e130c72cc05a266d
-FRAMEWORK_VERSION=7.4.17
-FRAMEWORK_COMMIT=c7f3c14c51fccba466761e8c0e7dafe4335acc16
+FRAMEWORK_VERSION=7.4.18
+FRAMEWORK_COMMIT=45d6d66b6ea1ef7a3c4193dfe606370f0f80c9bf
 SKELETON_URL="https://github.com/symfony/skeleton/archive/$SKELETON_COMMIT.tar.gz"
 
 PHP_INI="/etc/php/?.?/apache2/php.ini /etc/php/?.?/cli/php.ini"
diff --git a/docs/v19.0-testing.md b/docs/v19.0-testing.md
index d95cba6..5e62b9b 100644
--- a/docs/v19.0-testing.md
+++ b/docs/v19.0-testing.md
@@ -5,7 +5,7 @@
 | Criterion | Implementation boundary | Acceptance evidence |
 | --- | --- | --- |
 | Trixie appliance | The appliance inherits the v19 LAMP base and uses only Debian PHP, Composer, MariaDB, Apache, and Git packages. | The exact Wave 2 appliance run must complete with a Trixie APT policy and verified cleanup. |
-| Pinned official upstream | Symfony skeleton v7.4.99 is fetched by exact official commit and archive SHA256. FrameworkBundle v7.4.17 is pinned to its official split-package tag commit and recorded with the Composer lock digest. | `tests/v19.sh` compares runtime version, Composer lock source commit, lock digest, and the installed source record. |
+| Pinned official upstream | Symfony skeleton v7.4.99 is fetched by exact official commit and archive SHA256. FrameworkBundle v7.4.18 is pinned to its official split-package tag commit and recorded with the Composer lock digest. | `tests/v19.sh` compares runtime version, Composer lock source commit, lock digest, and the installed source record. |
 | Sample application | A small Symfony route renders the runtime version and a database-backed status value. | The runtime test requests `/` through Apache and requires all page markers. |
 | Database connectivity | Doctrine DBAL uses the generated MariaDB account in `.env.local`; the sample query reads `turnkey_status`. | The runtime test checks the same row through the Symfony DBAL console command, direct MariaDB, and HTTP. |
 | Framework console | `turnkey-symfony` invokes `bin/console` as `www-data` without shell interpolation. | The runtime test checks `about` in the production environment and runs a DBAL query. |