diff --git a/.github/workflows/auto-bump.yml b/.github/workflows/auto-bump.yml
index 24f79e42..36249933 100644
--- a/.github/workflows/auto-bump.yml
+++ b/.github/workflows/auto-bump.yml
@@ -119,7 +119,11 @@ jobs:
           git switch -c "$branch"
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git add Cargo.toml crates/*/Cargo.toml Cargo.lock packages docs/changelog.md docs/changelog
+          # `xtask/Cargo.toml` pins its siblings by exact version and lives outside
+          # `crates/`, so the glob above does not reach it. Left unstaged, the bump
+          # `set-release-version.py` made to it is dropped and the release workflow's
+          # version check rejects the candidate. §FS-rhei-distribution.2
+          git add Cargo.toml crates/*/Cargo.toml xtask/Cargo.toml Cargo.lock packages docs/changelog.md docs/changelog
           git commit -m "Release v${next}"
           git push -u origin "$branch"
 
diff --git a/docs/changelog.md b/docs/changelog.md
index 46c5fc46..a701782b 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+- **The release commit stages `xtask/Cargo.toml`.** `Auto bump` had failed on
+  its last three runs, always at `release.yml`'s version check and always before
+  the publish step, with `xtask/Cargo.toml internal dependency requirement is
+  stale: ... version = "=0.3.0"`. `set-release-version.py` bumps that pin
+  correctly — it goes out of its way to, and its docstring says why: "`xtask`
+  lives outside `crates/`, so a plain glob there silently leaves its pins at the
+  old version and the bump stops resolving." The release commit then staged
+  exactly that plain glob, so the bump lived in the runner's working tree, never
+  reached the candidate branch, and the verifier rejected it. The manifest is now
+  staged beside the others, with the reason recorded so the list is not trimmed
+  back later. (PR #113)
+
 - **The `rhei-plan-writer` skill says where a plan file belongs.** It specified
   the plan format, states, ids, and validation and never named a location, so an
   agent following it saved a plan at a host repository's root and `rhei init`