diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 64b77d4..ec1d117 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -28,6 +28,19 @@ updates:
         patterns:
           - "*"
 
+  - package-ecosystem: npm
+    directory: "/.github/release"
+    schedule:
+      interval: weekly
+    ignore:
+      # semantic-release 25 cannot render conventional-changelog-conventionalcommits 10
+      - dependency-name: "conventional-changelog-conventionalcommits"
+        update-types: ["version-update:semver-major"]
+    groups:
+      release-tooling:
+        patterns:
+          - "*"
+
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
diff --git a/.github/release/package.json b/.github/release/package.json
new file mode 100644
index 0000000..b0c372a
--- /dev/null
+++ b/.github/release/package.json
@@ -0,0 +1,7 @@
+{
+  "private": true,
+  "devDependencies": {
+    "conventional-changelog-conventionalcommits": "9.3.1",
+    "semantic-release": "25.0.9"
+  }
+}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 465ca8a..2c26293 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,5 +36,7 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # semantic-release 25 cannot render conventional-changelog-conventionalcommits 10
-        run: npx -p semantic-release@25.0.9 -p conventional-changelog-conventionalcommits@9.3.1 semantic-release
+        # own manifest without a lockfile: the npm bundled in semantic-release has advisories no override can reach
+        run: |
+          npm install --prefix .github/release --no-package-lock --no-audit --no-fund
+          .github/release/node_modules/.bin/semantic-release