diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d0ca41..d152adb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,10 +73,18 @@ jobs:
         id: changesets
         uses: changesets/action@v1
         with:
+          # `changeset:version` runs `changeset version && pnpm install
+          # --lockfile-only`, so the release PR carries an in-sync pnpm-lock.yaml.
+          # Without it the later `--frozen-lockfile` install fails on the bumped
+          # (but not-yet-published) internal versions, stalling every release.
+          version: pnpm run changeset:version
           title: 'chore: release packages'
           commit: 'chore: release packages'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Lets `changeset:version`'s lockfile refresh resolve restricted @etus
+          # deps (e.g. @etus/auth) from the registry while updating the lockfile.
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           HUSKY: '0'
 
       # Idempotent publish: skip if the local version is already on the
diff --git a/.npmrc b/.npmrc
index 9a5e138..6df6def 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,2 +1,7 @@
 @etus:registry=https://registry.npmjs.org/
 //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+# Resolve internal workspace deps (e.g. create-bhono -> @etus/bhono) to the local
+# package instead of the registry. Without this, a release bump points the dep at
+# a version that isn't published yet, so `pnpm install` can't resolve it and every
+# release stalls on the lockfile (ERR_PNPM_NO_MATCHING_VERSION / OUTDATED_LOCKFILE).
+link-workspace-packages=true
diff --git a/package.json b/package.json
index 4b0c1fe..28772ab 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "test:e2e:prod:auth": "tsx scripts/capture-prod-session.ts",
     "test": "pnpm test:unit && pnpm test:integration && pnpm test:e2e",
     "changeset": "changeset",
-    "changeset:version": "changeset version",
+    "changeset:version": "changeset version && pnpm install --lockfile-only",
     "changeset:publish": "changeset publish",
     "prepare": "husky || true",
     "test:run": "pnpm test:unit:server && pnpm test:unit:client",