diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3396d5f..1ff2f87 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,9 +29,6 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Install dependencies
-        run: npm install
-
       - name: Configure Git
         run: |
           git config --global user.name 'github-actions[bot]'
@@ -40,6 +37,14 @@ jobs:
       - name: Bump version
         run: "npm version ${{ github.event.inputs.release_type }} -m 'chore: release v%s'"
 
+      - name: Install dependencies
+        run: npm install
+
+      - name: Commit lockfile if changed
+        run: |
+          git add package-lock.json || true
+          git diff --cached --quiet || git commit -m 'chore: update package-lock.json'
+
       - name: Push changes and tags
         run: |
           git pull --rebase origin main