diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f334b6f..18dbd97 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write # push the per-template git tags (template_<id>_<version>)
   packages: write
 
 jobs:
diff --git a/README.md b/README.md
index b469655..826d9e0 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,11 @@ npx @devcontainers/cli templates apply --workspace-folder . \
 
 Then edit the `environment:` block in the generated
 `.devcontainer/docker-compose.yml` to the env vars your app reads (host =
-Compose service name, port = container port), and open the repo in the
-container. `db-up`-style scripts are not needed (and don't work) inside the
-workspace — the services are already running.
+Compose service name, port = container port), and open the repo with
+**"Dev Containers: Clone Repository in Container Volume…"** — the workspace
+has no host bind mounts, so a machine needs only Docker + VS Code (no host
+git or Node). `db-up`-style scripts are not needed (and don't work) inside
+the workspace — the services are already running.
 
 Both templates can also be applied from the VS Code / Dev Containers UI:
 "Add Dev Container Configuration Files…" and search for the template id.
diff --git a/src/sibling-services/.devcontainer/docker-compose.yml b/src/sibling-services/.devcontainer/docker-compose.yml
index b4c107a..d170233 100644
--- a/src/sibling-services/.devcontainer/docker-compose.yml
+++ b/src/sibling-services/.devcontainer/docker-compose.yml
@@ -17,8 +17,11 @@ services:
   dev:
     image: mcr.microsoft.com/devcontainers/javascript-node:${templateOption:nodeVersion}
     command: sleep infinity
-    volumes:
-      - ..:/workspaces/${templateOption:appName}:cached
+    # No host bind mounts on purpose: open the repo with "Dev Containers:
+    # Clone Repository in Container Volume…", which mounts the cloned repo
+    # volume at /workspaces. A `..:/workspaces/<app>` host bind would break
+    # that flow on a machine with no host checkout, and host-side tooling
+    # does not inject a workspace mount for Compose dev containers.
     environment:
       # Point the app at the sibling services by service name. Adjust the
       # variable names and credentials to what this repo actually uses.
diff --git a/src/sibling-services/NOTES.md b/src/sibling-services/NOTES.md
index 068b3e8..1ac9145 100644
--- a/src/sibling-services/NOTES.md
+++ b/src/sibling-services/NOTES.md
@@ -1,5 +1,10 @@
 # Next steps
 
+Open the repo with **"Dev Containers: Clone Repository in Container
+Volume…"** — the workspace deliberately has no host bind mounts, so the
+host needs only Docker + VS Code (no git checkout, no Node). The source
+lives in the repo volume at `/workspaces` and is edited through VS Code.
+
 1. In `.devcontainer/docker-compose.yml`, set the `environment:` entries to
    the connection strings your app actually reads (host = the Compose
    service name, port = the *container* port, not the host-published one).
diff --git a/src/sibling-services/devcontainer-template.json b/src/sibling-services/devcontainer-template.json
index f7bc139..04ee8a4 100644
--- a/src/sibling-services/devcontainer-template.json
+++ b/src/sibling-services/devcontainer-template.json
@@ -1,6 +1,6 @@
 {
   "id": "sibling-services",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "name": "Rocicorp Node workspace + sibling Compose services",
   "description": "Node.js dev container that runs the repo's existing docker-compose services (e.g. Postgres) as sibling containers. The workspace reaches them over the Compose network by service name but has no Docker daemon and no host Docker socket.",
   "documentationURL": "https://github.com/rocicorp/devcontainer-templates/tree/main/src/sibling-services",