diff --git a/.githooks/commit-msg b/.githooks/commit-msg
index 721581a..a8a29d3 100755
--- a/.githooks/commit-msg
+++ b/.githooks/commit-msg
@@ -1,2 +1,7 @@
 #!/usr/bin/env bash
-npx -y conventional-commit-msg "$1"
\ No newline at end of file
+# `@latest` + explicit `--package` dodge two npm footguns: an inherited
+# npm_config_package (agent wrappers like axexec/axrun set it, hijacking
+# `npx -y` into exit 127), and local-root shadowing — without the version,
+# `npm exec` resolves the conventional-commit-msg repo's own package and the
+# bin is "not found", breaking the hook in that repo after prepare wires it up.
+npm exec --yes --package=conventional-commit-msg@latest -- conventional-commit-msg "$1"