diff --git a/.github/workflows/deploy-pg-protocol.yml b/.github/workflows/deploy-pg-protocol.yml
index 12d22333c..d85a6b230 100644
--- a/.github/workflows/deploy-pg-protocol.yml
+++ b/.github/workflows/deploy-pg-protocol.yml
@@ -6,6 +6,7 @@ on:
       - master
     paths:
       - 'packages/pg-protocol/**'
+      - '.github/workflows/deploy-pg-protocol.yml'
   workflow_dispatch:
     inputs:
       version:
@@ -20,6 +21,16 @@ permissions:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    # IMPORTANT: install/build/publish strictly inside packages/pg-protocol/
+    # to avoid touching the workspace root. The root yarn.lock contains the
+    # `pg-protocol: npm:@supabase/pg-protocol@^X.Y.Z` alias, which would fail
+    # resolution any time we bump pg-protocol's version (the new version is
+    # not on npm yet — that's exactly what this workflow is publishing).
+    # pg-protocol has no runtime deps and only TS toolchain devDeps, so
+    # `npm install` inside the package directory is fully self-contained.
+    defaults:
+      run:
+        working-directory: packages/pg-protocol
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -29,15 +40,19 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile
+      - name: Install pg-protocol devDependencies (isolated, no workspace root)
+        # --workspaces=false + --prefix . is required to stop npm from
+        # walking up to the workspace root package.json. Without it, npm
+        # tries to resolve every workspace package's deps and trips on
+        # the unpublished `@supabase/pg-protocol@^X.Y.Z` alias in pg.
+        run: npm install --no-package-lock --no-audit --no-fund --workspaces=false --prefix .
 
       - name: Build package
-        run: cd packages/pg-protocol && yarn build
+        run: npm run build
 
       # Ensure npm 11.5.1 or later is installed for trusted publishing support
       - name: Update npm
         run: npm install -g npm@latest
 
       - name: Publish to npm
-        run: cd packages/pg-protocol && npm publish
+        run: npm publish
diff --git a/.github/workflows/deploy-pg.yml b/.github/workflows/deploy-pg.yml
index 1621ddf91..29af67afe 100644
--- a/.github/workflows/deploy-pg.yml
+++ b/.github/workflows/deploy-pg.yml
@@ -6,6 +6,7 @@ on:
       - master
     paths:
       - 'packages/pg/**'
+      - '.github/workflows/deploy-pg.yml'
   workflow_dispatch:
     inputs:
       version:
@@ -20,6 +21,17 @@ permissions:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    # IMPORTANT: do NOT run a workspace-root install here. pg's
+    # package.json declares `pg-protocol: npm:@supabase/pg-protocol@^X.Y.Z`,
+    # and any time we bump pg-protocol's version this workflow would fire
+    # before that version is on npm (deploy-pg-protocol.yml runs in
+    # parallel on the same merge commit). Workspace install would then
+    # fail at resolution. pg is plain JavaScript (no build step, no TS
+    # compile), so `npm publish` can pack the source files listed under
+    # the `files` field directly without resolving any dependencies.
+    defaults:
+      run:
+        working-directory: packages/pg
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -29,12 +41,9 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile
-
       # Ensure npm 11.5.1 or later is installed for trusted publishing support
       - name: Update npm
         run: npm install -g npm@latest
 
       - name: Publish to npm
-        run: cd packages/pg && npm publish
+        run: npm publish