diff --git a/packages/trilean-sql/package.json b/packages/trilean-sql/package.json
index 1cc0d4d..739ff3d 100644
--- a/packages/trilean-sql/package.json
+++ b/packages/trilean-sql/package.json
@@ -47,8 +47,8 @@
   },
   "license": "MIT",
   "dependencies": {
-    "trilean": "workspace:^",
-    "trilean-regex": "workspace:^"
+    "trilean": "1.6.1",
+    "trilean-regex": "1.0.2"
   },
   "scripts": {
     "build": "turbo run _build",
diff --git a/packages/trilean/package.json b/packages/trilean/package.json
index 088c3b7..03f2c9c 100644
--- a/packages/trilean/package.json
+++ b/packages/trilean/package.json
@@ -49,7 +49,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "trilean-regex": "workspace:^",
+    "trilean-regex": "1.0.2",
     "zod": "^4.5.4"
   },
   "scripts": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4a6f8c8..da7cd1c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -245,7 +245,7 @@ importers:
   packages/trilean:
     dependencies:
       trilean-regex:
-        specifier: workspace:^
+        specifier: 1.0.2
         version: link:../trilean-regex
       zod:
         specifier: ^4.5.4
@@ -357,10 +357,10 @@ importers:
   packages/trilean-sql:
     dependencies:
       trilean:
-        specifier: workspace:^
+        specifier: 1.6.1
         version: link:../trilean
       trilean-regex:
-        specifier: workspace:^
+        specifier: 1.0.2
         version: link:../trilean-regex
     devDependencies:
       '@arethetypeswrong/cli':
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f49d744..a9be544 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,9 +1,14 @@
 packages:
   - "packages/*"
 
-# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not. There is one package here today, so nothing exercises it yet -- it is set now so the first sibling added is linked rather than silently downloaded.
+# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not.
 linkWorkspacePackages: true
 
+# Sibling dependencies are declared as plain exact versions, never with the `workspace:` protocol. The release publishes through `npm publish`, which copies the manifest verbatim and does not understand `workspace:`, so a `workspace:^` range would reach the registry as-is and make the package uninstallable for every consumer. `@exadev/semantic-release-workspace` maintains plain ranges itself, rewriting each dependent's range when the sibling releases, and linkWorkspacePackages above still symlinks the sibling locally whenever the workspace version satisfies it.
+#
+# pnpm's default for this setting is `rolling`, under which `pnpm add <sibling>` writes `workspace:^`. false makes it write the plain version instead, using saveExact below for the exact pin.
+saveWorkspaceProtocol: false
+
 # Every dependency in the tree that ships an install script, and whether it may run. pnpm 11 ignores install scripts unless listed, and fails the install outright while any is neither allowed nor refused -- so an entry is a decision recorded, not merely a permission granted, and `false` is as meaningful an answer as `true`.
 #
 # workerd (the Cloudflare Workers runtime @cloudflare/vitest-pool-workers drives the workers test suite through) and esbuild (its bundler) both need theirs: the script is how each fetches its own platform's binary, and neither runs at all without it.