diff --git a/.changeset/config.json b/.changeset/config.json
index 5186b5f..eeea767 100644
--- a/.changeset/config.json
+++ b/.changeset/config.json
@@ -1,11 +1,17 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4/schema.json",
   "access": "public",
   "baseBranch": "main",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
   "fixed": [],
-  "ignore": [],
+  "ignore": [
+    "@gtbuchanan/test-utils"
+  ],
   "linked": [],
+  "privatePackages": {
+    "tag": false,
+    "version": true
+  },
   "updateInternalDependencies": "patch"
 }
diff --git a/.changeset/private-packages-versioning.md b/.changeset/private-packages-versioning.md
new file mode 100644
index 0000000..922e5de
--- /dev/null
+++ b/.changeset/private-packages-versioning.md
@@ -0,0 +1,21 @@
+---
+---
+
+Restore private-package versioning after the `@changesets/cli` v3 upgrade.
+
+v3 changed the `privatePackages` default from `{ tag: false, version: true }`
+to `false`, and the upgrade landed as a bare dependency bump with no config
+migration. That silently dropped `@gtbuchanan/hk-config` out of
+`changeset version`, freezing the version that `gtb sync` stamps into
+`PklProject` and that `gtb publish` derives the release tag from — so the next
+`Defaults.pkl` change would have been skipped by the release-exists check and
+never shipped to consumers, with no error.
+
+`privatePackages.version` is global, so `@gtbuchanan/test-utils` is added to
+`ignore` to keep the gate scoped to the one private package whose version is
+load-bearing. It is a `devDependency` everywhere it appears, and changesets'
+skipped-dependents validation ignores devDependency edges, so the entry raises
+no `Invalid tree` error.
+
+Also repoints `$schema` at the v4 config schema, which the v3 upgrade left
+stale — the correct schema is what surfaces `privatePackages` in an editor.
diff --git a/AGENTS.md b/AGENTS.md
index a057d10..16ea55b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -658,3 +658,29 @@ For PRs that don't affect published packages, create an empty changeset
 
 Update CI workflow
 ```
+
+### Changesets private-package versioning
+
+`.changeset/config.json` sets `privatePackages` to
+`{ "tag": false, "version": true }` explicitly. This is **not** a redundant
+restatement of a default — `@changesets/cli` v3 flipped the default to `false`,
+and without the override `@gtbuchanan/hk-config` drops out of
+`changeset version` entirely. Nothing errors when that happens: `gtb sync`
+stamps the frozen `package.json` version into `PklProject`, `gtb publish`
+derives the same release tag it published last time, and the skip-if-exists
+check treats it as already released. The Pkl channel silently stops shipping.
+`tag` stays `false` because `gtb publish` creates the GitHub release itself;
+changesets' own tagging is unused here.
+
+`privatePackages.version` is global, so `ignore` narrows it to the one private
+package whose version is load-bearing. `@gtbuchanan/test-utils` is listed there
+because it exists only as a `devDependency` — it has no published surface, and
+changesets' skipped-dependents validation passes `ignoreDevDependencies: true`,
+so ignoring it raises no `Invalid tree` error. `gtb verify manifest`
+independently forbids a published package from taking a private workspace
+package as a runtime dependency, so that stays true.
+
+Note that `changeset status` only asserts that _some_ changeset exists once any
+versionable package changed — it does not check that a changeset covers the
+package that actually changed. Treat it as a prompt to think about the release,
+not as proof the right package got bumped.