diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d9cceb9..a59ffec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,9 +17,9 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
+      # No version here on purpose: it reads `packageManager` from
+      # package.json, so the pnpm version has one source of truth.
       - uses: pnpm/action-setup@v4
-        with:
-          version: 11.17.0
       - uses: actions/setup-node@v4
         with:
           node-version: 24
diff --git a/package.json b/package.json
index 15f506c..c108935 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,7 @@
   "version": "0.0.1",
   "type": "module",
   "private": true,
+  "packageManager": "pnpm@11.17.0",
   "engines": {
     "node": "24.x"
   },
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7daa764..cf041c9 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,10 @@
+# This repo is not a workspace. The file exists only to hold pnpm settings.
+#
+# `allowBuilds` and `minimumReleaseAgeExclude` are pnpm 11 keys, and pnpm 10
+# rejects a workspace file that has no `packages` field. `package.json` pins
+# `packageManager` to pnpm 11 so every environment agrees, including the
+# Cloudflare build image, which defaults to pnpm 10.
+#
 # Postinstall scripts pnpm is allowed to run. Without these, `pnpm <script>`
 # aborts on its dependency-status check. esbuild backs Vitest, workerd backs the
 # Cloudflare Vite plugin and `wrangler dev`, and sharp backs vite-imagetools.