diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ddff1460..43b61c45 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,10 +1,10 @@
 # Replace @dotta if a different maintainer or team should own release infrastructure.
 
-.github/workflows/release.yml @dotta
-scripts/release*.sh @dotta
-scripts/release-*.mjs @dotta
-scripts/create-github-release.sh @dotta
-scripts/rollback-latest.sh @dotta
-doc/RELEASING.md @dotta
-doc/PUBLISHING.md @dotta
-doc/RELEASE-AUTOMATION-SETUP.md @dotta
+.github/** @dotta @devinfoley
+scripts/release*.sh @dotta @devinfoley
+scripts/release-*.mjs @dotta @devinfoley
+scripts/create-github-release.sh @dotta @devinfoley
+scripts/rollback-latest.sh @dotta @devinfoley
+doc/RELEASING.md @dotta @devinfoley
+doc/PUBLISHING.md @dotta @devinfoley
+doc/RELEASE-AUTOMATION-SETUP.md @dotta @devinfoley
diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml
index a879e5bc..9f28fc28 100644
--- a/.github/workflows/refresh-lockfile.yml
+++ b/.github/workflows/refresh-lockfile.yml
@@ -79,3 +79,15 @@ jobs:
           else
             echo "PR #$existing already exists, branch updated via force push."
           fi
+
+      - name: Enable auto-merge for lockfile PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          pr_url="$(gh pr list --head chore/refresh-lockfile --json url --jq '.[0].url')"
+          if [ -z "$pr_url" ]; then
+            echo "Error: lockfile PR was not found." >&2
+            exit 1
+          fi
+
+          gh pr merge --auto --squash --delete-branch "$pr_url"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5342b20f..1ef1726b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -92,6 +92,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Restore tracked install-time changes
+        run: git checkout -- pnpm-lock.yaml
+
       - name: Configure git author
         run: |
           git config user.name "github-actions[bot]"
@@ -218,6 +221,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
+      - name: Restore tracked install-time changes
+        run: git checkout -- pnpm-lock.yaml
+
       - name: Configure git author
         run: |
           git config user.name "github-actions[bot]"
diff --git a/doc/RELEASE-AUTOMATION-SETUP.md b/doc/RELEASE-AUTOMATION-SETUP.md
index 7e629c14..7f77003a 100644
--- a/doc/RELEASE-AUTOMATION-SETUP.md
+++ b/doc/RELEASE-AUTOMATION-SETUP.md
@@ -16,6 +16,7 @@ Note:
 
 - the release workflows intentionally use `pnpm install --no-frozen-lockfile`
 - this matches the repo's current policy where `pnpm-lock.yaml` is refreshed by GitHub automation after manifest changes land on `master`
+- the publish jobs then restore `pnpm-lock.yaml` before running `scripts/release.sh`, so the release script still sees a clean worktree
 
 ## 1. Merge the Repo Changes First