diff --git a/.github/workflows/scripts/patch_semver_build_dependencies.sh b/.github/workflows/scripts/patch_semver_build_dependencies.sh
new file mode 100755
index 0000000000..7395d45935
--- /dev/null
+++ b/.github/workflows/scripts/patch_semver_build_dependencies.sh
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# cargo-semver-checks resolves outside the workspace lock file. Repair dependency
+# build failures in both current and published-baseline builds through an isolated
+# Cargo home; the compared Zakura sources and API checks are unchanged.
+readonly tinyvec_version=1.13.0
+readonly original_cargo_home="${CARGO_HOME:-$HOME/.cargo}"
+patch_root=$(mktemp -d "$RUNNER_TEMP/dependencies-semver.XXXXXX")
+readonly patch_root
+readonly patched_cargo_home="$patch_root/cargo-home"
+readonly patched_source="$patch_root/tinyvec-$tinyvec_version"
+
+copy_registry_source() {
+  local package="$1" version="$2"
+  cargo info "$package@$version" >/dev/null
+  local -a sources
+  mapfile -t sources < <(
+    find "$original_cargo_home/registry/src" -mindepth 2 -maxdepth 2 -type d \
+      -name "$package-$version"
+  )
+  if (( ${#sources[@]} != 1 )); then
+    echo "expected one $package $version source directory, found ${#sources[@]}" >&2
+    exit 1
+  fi
+  cp -a "${sources[0]}" "$patch_root/$package-$version"
+}
+
+copy_registry_source tinyvec "$tinyvec_version"
+# Published Zakura versions cannot inherit the workspace's RocksDB feature fix.
+# Give their bindgen 0.72 instance its own libclang loader, even when another
+# bindgen version enables clang-sys runtime loading in the same dependency graph.
+readonly rocksdb_sys_version=0.17.3+10.4.2
+readonly patched_rocksdb_sys="$patch_root/librocksdb-sys-$rocksdb_sys_version"
+copy_registry_source librocksdb-sys "$rocksdb_sys_version"
+
+python3 - "$patched_source" "$patched_rocksdb_sys" <<'PYTHON'
+from pathlib import Path
+import sys
+
+
+def replace_once(path, before, after):
+    text = path.read_text()
+    if text.count(before) != 1:
+        raise SystemExit(f"{path} no longer matches the expected dependency source")
+    path.write_text(text.replace(before, after))
+
+
+# tinyvec 1.13.0 omits the alloc::vec macro import in its alloc-only build.
+replace_once(
+    Path(sys.argv[1]) / "src/tinyvec.rs",
+    "use alloc::vec::{self, Vec};",
+    "use alloc::{vec, vec::Vec};",
+)
+replace_once(
+    Path(sys.argv[2]) / "Cargo.toml",
+    '[build-dependencies.bindgen]\nversion = "0.72"\ndefault-features = false\n',
+    '[build-dependencies.bindgen]\nversion = "0.72"\nfeatures = ["runtime"]\ndefault-features = false\n',
+)
+PYTHON
+
+mkdir -p "$patched_cargo_home"
+ln -s "$original_cargo_home/registry" "$patched_cargo_home/registry"
+if [[ -d "$original_cargo_home/git" ]]; then
+  ln -s "$original_cargo_home/git" "$patched_cargo_home/git"
+fi
+cat > "$patched_cargo_home/config.toml" <<EOF
+[patch.crates-io]
+tinyvec = { path = "$patched_source" }
+librocksdb-sys = { path = "$patched_rocksdb_sys" }
+EOF
+
+echo "CARGO_HOME=$patched_cargo_home" >> "$GITHUB_ENV"
diff --git a/.github/workflows/scripts/patch_tinyvec_for_rustdoc.sh b/.github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
deleted file mode 100755
index 477180f26f..0000000000
--- a/.github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-# tinyvec 1.13.0 omits the alloc::vec macro import in its alloc-only build.
-# cargo-semver-checks resolves dependencies outside the workspace lock file, so
-# patch both its current and published-baseline builds through an isolated Cargo home.
-readonly tinyvec_version=1.13.0
-readonly original_cargo_home="${CARGO_HOME:-$HOME/.cargo}"
-patch_root=$(mktemp -d "$RUNNER_TEMP/tinyvec-semver.XXXXXX")
-readonly patch_root
-readonly patched_cargo_home="$patch_root/cargo-home"
-readonly patched_source="$patch_root/tinyvec-$tinyvec_version"
-
-cargo info "tinyvec@$tinyvec_version" >/dev/null
-
-mapfile -t source_candidates < <(
-  find "$original_cargo_home/registry/src" -mindepth 2 -maxdepth 2 -type d \
-    -name "tinyvec-$tinyvec_version"
-)
-if (( ${#source_candidates[@]} != 1 )); then
-  echo "expected one tinyvec $tinyvec_version source directory, found ${#source_candidates[@]}" >&2
-  exit 1
-fi
-
-cp -a "${source_candidates[0]}" "$patched_source"
-readonly source_file="$patched_source/src/tinyvec.rs"
-if [[ "$(grep -Fxc 'use alloc::vec::{self, Vec};' "$source_file")" != 1 ]]; then
-  echo "tinyvec $tinyvec_version no longer matches the expected broken source" >&2
-  exit 1
-fi
-sed -i 's/use alloc::vec::{self, Vec};/use alloc::{vec, vec::Vec};/' "$source_file"
-
-mkdir -p "$patched_cargo_home"
-ln -s "$original_cargo_home/registry" "$patched_cargo_home/registry"
-if [[ -d "$original_cargo_home/git" ]]; then
-  ln -s "$original_cargo_home/git" "$patched_cargo_home/git"
-fi
-cat > "$patched_cargo_home/config.toml" <<EOF
-[patch.crates-io]
-tinyvec = { path = "$patched_source" }
-EOF
-
-echo "CARGO_HOME=$patched_cargo_home" >> "$GITHUB_ENV"
diff --git a/.github/workflows/semver-checks.yml b/.github/workflows/semver-checks.yml
index b7c6aab92f..1a9e9674cb 100644
--- a/.github/workflows/semver-checks.yml
+++ b/.github/workflows/semver-checks.yml
@@ -39,7 +39,7 @@ on:
       - "**/Cargo.lock"
       - .github/workflows/semver-checks.yml
       - .github/workflows/scripts/affected_semver_packages.py
-      - .github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
+      - .github/workflows/scripts/patch_semver_build_dependencies.sh
       - .github/workflows/scripts/test_affected_semver_packages.py
   push:
     branches: [main]
@@ -49,7 +49,7 @@ on:
       - "**/Cargo.lock"
       - .github/workflows/semver-checks.yml
       - .github/workflows/scripts/affected_semver_packages.py
-      - .github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
+      - .github/workflows/scripts/patch_semver_build_dependencies.sh
       - .github/workflows/scripts/test_affected_semver_packages.py
 
   # Run in the merge queue so queued changes are revalidated against the latest
@@ -204,8 +204,8 @@ jobs:
 
       - uses: ./.github/actions/setup-zakura-build
 
-      - name: Patch tinyvec for alloc-only rustdoc builds
-        run: .github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
+      - name: Repair dependencies for semver builds
+        run: .github/workflows/scripts/patch_semver_build_dependencies.sh
 
       - name: Check package against its stable crates.io baseline
         env:
@@ -257,8 +257,8 @@ jobs:
 
       - uses: ./.github/actions/setup-zakura-build
 
-      - name: Patch tinyvec for alloc-only rustdoc builds
-        run: .github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
+      - name: Repair dependencies for semver builds
+        run: .github/workflows/scripts/patch_semver_build_dependencies.sh
 
       - name: Install nightly rustdoc toolchain
         run: rustup toolchain install nightly --profile minimal
@@ -307,8 +307,8 @@ jobs:
 
       - uses: ./.github/actions/setup-zakura-build
 
-      - name: Patch tinyvec for alloc-only rustdoc builds
-        run: .github/workflows/scripts/patch_tinyvec_for_rustdoc.sh
+      - name: Repair dependencies for semver builds
+        run: .github/workflows/scripts/patch_semver_build_dependencies.sh
 
       - name: Check all crates and warm published release baselines
         id: warm
diff --git a/Cargo.toml b/Cargo.toml
index 386ba8457e..84d0f2df02 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -135,7 +135,8 @@ regex = "1.11"
 reqwest = { version = "0.12", default-features = false }
 ripemd = "0.1"
 rlimit = "0.10"
-rocksdb = { version = "0.24", default-features = false }
+# Load libclang without relying on another crate enabling the same bindgen version.
+rocksdb = { version = "0.24", default-features = false, features = ["bindgen-runtime"] }
 secp256k1 = "0.29"
 semver = "1.0.26"
 sentry = { version = "0.47", default-features = false }
diff --git a/docs/changelog/unreleased/905.md b/docs/changelog/unreleased/905.md
new file mode 100644
index 0000000000..304dfdbff2
--- /dev/null
+++ b/docs/changelog/unreleased/905.md
@@ -0,0 +1,5 @@
+## Fixed
+
+- Fixed isolated state and RPC library builds that could fail to load libclang
+  when dependencies resolve multiple bindgen versions
+  ([#905](https://github.com/zakura-core/zakura/pull/905)).