diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 988e67d..45aa74a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,9 @@
 name: ci
 
-# The harness's own self-test, on PHP 8.4 and 8.5. The committed composer.json declares no
-# repositories and requires the middlewares at @dev, so this resolves them from Packagist. It turns
-# green once the middleware changes the harness exercises are released to their main branches.
+# The harness's own self-test, on PHP 8.4 and 8.5. The committed composer.json declares no repositories, so
+# this resolves the middlewares from Packagist: the WSSE one from its active development branch, v4.x, rather
+# than from the stale default branch. It turns green once the middleware changes the harness exercises have
+# landed there.
 on:
   push:
   pull_request:
diff --git a/composer.json b/composer.json
index 062854b..fb124aa 100644
--- a/composer.json
+++ b/composer.json
@@ -12,7 +12,7 @@
         "php": "~8.4.0 || ~8.5.0",
         "ext-dom": "*",
         "ext-openssl": "*",
-        "php-soap/psr18-wsse-middleware": "@dev",
+        "php-soap/psr18-wsse-middleware": "4.x-dev",
         "php-soap/psr18-attachments-middleware": "@dev",
         "nyholm/psr7": "^1.8",
         "symfony/http-client": "^7.1"