diff --git a/package-lock.json b/package-lock.json
index acd553c..dcbe118 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8013,7 +8013,7 @@
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.30.0",
-        "modelparams": "0.0.56",
+        "modelparams": "*",
         "zod": "^3.25.0"
       },
       "bin": {
diff --git a/packages/modelparams-mcp/README.md b/packages/modelparams-mcp/README.md
index a07fb78..ec66195 100644
--- a/packages/modelparams-mcp/README.md
+++ b/packages/modelparams-mcp/README.md
@@ -109,7 +109,7 @@ One entry documents one wire format, so `validate_model_params` answers for the
 
 The catalog is compiled in at publish time from the YAML source of truth at [github.com/mnfst/modelparams.dev](https://github.com/mnfst/modelparams.dev/tree/main/models). No runtime fetch, no cache to invalidate — update the package to get new models.
 
-The hosted endpoint is rebuilt with the site on every catalog change, so it always answers from the current catalog. A local build of this package pins an exact [`modelparams`](https://www.npmjs.com/package/modelparams) dependency instead, and answers from whichever catalog version that pin resolves.
+The hosted endpoint is rebuilt with the site on every catalog change, so it always answers from the current catalog. A local build of this package takes [`modelparams`](https://www.npmjs.com/package/modelparams) straight from this workspace — the dependency is deliberately unpinned, because the package is not published and an exact pin only froze it at a version the workspace had already moved past.
 
 ## License
 
diff --git a/packages/modelparams-mcp/package.json b/packages/modelparams-mcp/package.json
index 62b3c92..5034455 100644
--- a/packages/modelparams-mcp/package.json
+++ b/packages/modelparams-mcp/package.json
@@ -54,6 +54,6 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^3.25.0",
-    "modelparams": "0.0.56"
+    "modelparams": "*"
   }
 }
diff --git a/tests/release-lockfiles.test.ts b/tests/release-lockfiles.test.ts
index af22aee..b12e790 100644
--- a/tests/release-lockfiles.test.ts
+++ b/tests/release-lockfiles.test.ts
@@ -20,11 +20,27 @@ describe("bumpPackageLockVersion", () => {
     expect(split(updated, "modelparams").entry).toContain('"version": "9.9.9"');
   });
 
-  it("moves the exact sibling pin the MCP package ships in lockstep", () => {
-    const updated = bumpPackageLockVersion(lock, "9.9.9", "modelparams-mcp", ["modelparams"]);
-    const { entry } = split(updated, "modelparams-mcp");
-    expect(entry).toContain('"version": "9.9.9"');
-    expect(entry).toContain('"modelparams": "9.9.9"');
+  // No workspace pins a sibling exactly today — modelparams-mcp did until it
+  // stopped being published — so this exercises the repinning against a
+  // fixture. Keep it: the day another package pins a sibling, a release that
+  // moves one and not the other breaks `npm ci` for every job on the PR.
+  it("moves an exact sibling pin alongside the version", () => {
+    const fixture = [
+      "{",
+      '  "packages": {',
+      '    "packages/pinning-workspace": {',
+      '      "version": "0.0.1",',
+      '      "dependencies": {',
+      '        "modelparams": "0.0.1"',
+      "      }",
+      "    }",
+      "  }",
+      "}",
+    ].join("\n");
+
+    const updated = bumpPackageLockVersion(fixture, "9.9.9", "pinning-workspace", ["modelparams"]);
+    expect(updated).toContain('"version": "9.9.9"');
+    expect(updated).toContain('"modelparams": "9.9.9"');
   });
 
   it("leaves every other entry untouched", () => {
@@ -36,8 +52,8 @@ describe("bumpPackageLockVersion", () => {
   });
 
   it("is idempotent, so a re-prepared release branch converges", () => {
-    const once = bumpPackageLockVersion(lock, "9.9.9", "modelparams-mcp", ["modelparams"]);
-    expect(bumpPackageLockVersion(once, "9.9.9", "modelparams-mcp", ["modelparams"])).toBe(once);
+    const once = bumpPackageLockVersion(lock, "9.9.9", "modelparams");
+    expect(bumpPackageLockVersion(once, "9.9.9", "modelparams")).toBe(once);
   });
 
   it("fails loudly rather than silently skipping an unknown workspace", () => {