diff --git a/.github/scripts/release.mjs b/.github/scripts/release.mjs
new file mode 100644
index 0000000000..7330ed3ae4
--- /dev/null
+++ b/.github/scripts/release.mjs
@@ -0,0 +1,28 @@
+import { execFileSync } from "node:child_process";
+
+const mode = process.argv[2];
+
+const run = (args) => execFileSync("pnpm", args, { stdio: "inherit" });
+
+// changesets/action runs `git checkout changeset-release/main` + `git reset
+// --hard` immediately before this, which can leave the deps state out of
+// sync with pnpm-workspace.yaml. The next gated pnpm call
+// (verifyDepsBeforeRun: error) would then abort the release. `pnpm install`
+// is not gated, so reconcile here, after the action's git work and before
+// any `pnpm changeset` call. Do not hoist this into an earlier workflow
+// step: the action's git reset runs after workflow steps and undoes it.
+// Must be --no-frozen-lockfile, not --prefer-frozen-lockfile: prefer-frozen
+// can take the lockfile fast path and skip rewriting the stale deps-state
+// hash, which is the exact condition that trips the gate.
+run(["install", "--no-frozen-lockfile"]);
+
+if (mode === "version") {
+	run(["changeset", "version"]);
+	run(["install", "--no-frozen-lockfile"]);
+} else if (mode === "publish") {
+	run(["changeset", "publish"]);
+} else {
+	throw new Error(
+		`Unknown release mode: ${JSON.stringify(mode)} (expected "version" or "publish")`,
+	);
+}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d300fa77e4..9ca4ac3bc5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,8 +71,8 @@ jobs:
         id: changesets
         uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
-          version: pnpm run changeset:version
-          publish: pnpm changeset publish
+          version: node .github/scripts/release.mjs version
+          publish: node .github/scripts/release.mjs publish
           commit: "ci: release"
           title: "ci: release"
         env:
@@ -80,7 +80,7 @@ jobs:
 
       - name: Publish (manual)
         if: ${{ inputs.publish-only }}
-        run: pnpm changeset publish
+        run: node .github/scripts/release.mjs publish
 
   sync-templates:
     name: Sync Templates
diff --git a/package.json b/package.json
index 9f6655c70c..9ede6eb309 100644
--- a/package.json
+++ b/package.json
@@ -28,8 +28,7 @@
 		"screenshots": "node scripts/screenshot-all-templates.mjs",
 		"query-counts": "node scripts/query-counts.mjs",
 		"locale:extract": "pnpm --filter @emdash-cms/admin locale:extract",
-		"locale:compile": "pnpm --filter @emdash-cms/admin locale:compile",
-		"changeset:version": "pnpm changeset version && pnpm install --no-frozen-lockfile"
+		"locale:compile": "pnpm --filter @emdash-cms/admin locale:compile"
 	},
 	"keywords": [],
 	"author": "Matt Kane",