diff --git a/.github/workflows/examples-integration.yaml b/.github/workflows/examples-integration.yaml
index 45d10e3fbe..6a94c03740 100644
--- a/.github/workflows/examples-integration.yaml
+++ b/.github/workflows/examples-integration.yaml
@@ -18,9 +18,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-      - uses: pnpm/action-setup@v2
-        with:
-          version: 10
+      - uses: pnpm/action-setup@v4
       - run: pnpm install
       - name: Build codegen and dependencies
         run: pnpm run build
diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
index 5fb8f87002..123e36964c 100644
--- a/.github/workflows/run-tests.yaml
+++ b/.github/workflows/run-tests.yaml
@@ -59,9 +59,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 10
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -133,9 +131,7 @@ jobs:
         run: tar -xzf workspace.tar.gz && rm workspace.tar.gz
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 10
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -179,9 +175,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 10
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -294,9 +288,7 @@ jobs:
           git config --global user.email "ci@example.com"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 10
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -416,9 +408,7 @@ jobs:
           git config --global user.email "ci@example.com"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 10
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -502,9 +492,7 @@ jobs:
           git config --global user.email "ci@example.com"
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v2
-        with:
-          version: 10
+        uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
diff --git a/package.json b/package.json
index 98f2fa1e97..fd40a5aae9 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,7 @@
 {
   "name": "constructive",
   "version": "2.0.0",
+  "packageManager": "pnpm@10.34.5",
   "author": "Constructive <developers@constructive.io>",
   "private": true,
   "repository": {
@@ -54,39 +55,5 @@
   },
   "overrides": {
     "graphql": "^16.9.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "grafast": "1.1.1",
-      "grafserv": "1.0.1",
-      "graphile-build": "5.1.1",
-      "graphile-build-pg": "5.1.3",
-      "graphile-config": "1.1.0",
-      "graphile-utils": "5.0.3",
-      "postgraphile": "5.1.3",
-      "pg-sql2": "5.0.1",
-      "pg-introspection": "1.0.1",
-      "tamedevil": "0.1.1",
-      "@dataplan/pg": "1.1.1",
-      "@dataplan/json": "1.0.1",
-      "@graphile/lru": "5.0.0",
-      "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-      "graphql": "16.13.0",
-      "@smithy/node-http-handler": "<4.5.0"
-    },
-    "publicHoistPattern": [
-      "@jest/test-sequencer"
-    ],
-    "packageExtensions": {
-      "jest-config@*": {
-        "dependencies": {
-          "@jest/test-sequencer": "^29.7.0"
-        }
-      }
-    },
-    "onlyBuiltDependencies": [
-      "@launchql/protobufjs",
-      "core-js-pure"
-    ]
   }
 }
diff --git a/pnpm-policy.yaml b/pnpm-policy.yaml
index 94eeffcbab..32fdf2441b 100644
--- a/pnpm-policy.yaml
+++ b/pnpm-policy.yaml
@@ -60,7 +60,9 @@ intersect: true
 # nx, protobufjs and unrs-resolver install without their scripts and the build
 # works. An install script is arbitrary code at install time, so each addition is
 # a deliberate decision and the value is the reason.
-allowBuilds: []
+allowBuilds:
+  '@launchql/protobufjs': true
+  core-js-pure: true
 
 # Escape hatch for third-party packages that cannot wait — an urgent security
 # release, typically. A reason is required, and `until` makes the waiver expire
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 037090353b..dc23df289e 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -77,3 +77,40 @@ minimumReleaseAgeExclude:
 
 # Off: transitive dependencies may resolve from git or a URL.
 blockExoticSubdeps: false
+
+# Moved from package.json `pnpm.*` — pnpm 11 no longer reads that field, and
+# pnpm 10 already honours these keys here, so this works on both majors.
+
+# The Graphile v5 stack is resolved as a set: grafast, graphile-build* and
+# @dataplan/* must agree, and a second copy of graphql produces
+# "Cannot use GraphQLSchema from another module or realm" at runtime.
+overrides:
+  grafast: 1.1.1
+  grafserv: 1.0.1
+  graphile-build: 5.1.1
+  graphile-build-pg: 5.1.3
+  graphile-config: 1.1.0
+  graphile-utils: 5.0.3
+  postgraphile: 5.1.3
+  pg-sql2: 5.0.1
+  pg-introspection: 1.0.1
+  tamedevil: 0.1.1
+  '@dataplan/pg': 1.1.1
+  '@dataplan/json': 1.0.1
+  '@graphile/lru': 5.0.0
+  '@graphile-contrib/pg-many-to-many': 2.0.0-rc.2
+  graphql: 16.13.0
+  '@smithy/node-http-handler': <4.5.0
+
+publicHoistPattern:
+  - '@jest/test-sequencer'
+
+packageExtensions:
+  'jest-config@*':
+    dependencies:
+      '@jest/test-sequencer': ^29.7.0
+
+# The only dependencies permitted to run install scripts.
+allowBuilds:
+  "@launchql/protobufjs": true
+  core-js-pure: true