diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 72fc798..512d246 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -27,6 +27,29 @@ updates:
         patterns:
           - "*"
 
+  - package-ecosystem: npm
+    # package.json holds only the release tooling that release.yml installs
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      release-tooling:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+      release-tooling-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+    ignore:
+      # preset 10 needs conventional-changelog-writer 9; semantic-release 25 bundles writer 8
+      - dependency-name: conventional-changelog-conventionalcommits
+        update-types:
+          - version-update:semver-major
+
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2999759..e14ce66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,17 +33,13 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 24
+      - name: Install the release tooling
+        run: npm install --no-package-lock --no-audit --no-fund
       - name: Build, tag and draft the GitHub release
         id: semantic-release
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        # Preset 10+ needs conventional-changelog-writer 9; semantic-release 25 bundles writer 8.
-        run: >
-          npx --yes
-          -p semantic-release@25.0.9
-          -p @semantic-release/exec@7.1.0
-          -p conventional-changelog-conventionalcommits@9.3.1
-          semantic-release
+        run: npx semantic-release
       - uses: actions/upload-artifact@v7
         if: steps.semantic-release.outputs.version
         with:
diff --git a/.gitignore b/.gitignore
index e73dbde..ee2dbf9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ __pycache__
 .tox
 .vscode
 .python-version
+node_modules/
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..38402b4
--- /dev/null
+++ b/package.json
@@ -0,0 +1,8 @@
+{
+  "private": true,
+  "devDependencies": {
+    "@semantic-release/exec": "7.1.0",
+    "conventional-changelog-conventionalcommits": "9.3.1",
+    "semantic-release": "25.0.9"
+  }
+}