diff --git a/.artifacts/release-qa-analyze.png b/.artifacts/release-qa-analyze.png
new file mode 100644
index 0000000..5a7cdc1
Binary files /dev/null and b/.artifacts/release-qa-analyze.png differ
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a31ef0..a9feb14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,19 @@ This file starts at 0.2.0. Everything before it is readable in the history but w
 here, and 0.1.0 shipped without a tag, so `v0.2.0` is the first release a reader can obtain by
 name.
 
+## 0.2.1 - 2026-08-13
+
+### Fixed
+
+- **`yarn install --frozen-lockfile` failed on a clean checkout of 0.2.0.** The version bump moved
+  the four packages to `0.2.0` but left `apps/web` asking for `@redrob/harness@0.1.0` and
+  `@redrob/harness` asking for `@redrob/tokenizers@0.1.0`, so yarn stopped resolving them from the
+  workspace and looked for private packages on npm. Every CI job that installs failed, while a
+  local install kept working because `node_modules` was already linked. The workspaces now depend
+  on each other by `"*"`, which resolves to the workspace whatever the version, so a future bump
+  cannot reintroduce this. `CONTRIBUTING.md` says so, and says to run a frozen-lockfile install on
+  the release branch, which is the check that would have caught it.
+
 ## 0.2.0 - 2026-08-13
 
 0.1.0 could compare models and settle quality by human preference. 0.2.0 is about what happens
diff --git a/CITATION.cff b/CITATION.cff
index 9a242bf..720415b 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -12,7 +12,7 @@ authors:
   - family-names: Lee
     given-names: Janghoon
     alias: "이장훈"
-version: 0.2.0
+version: 0.2.1
 date-released: "2026-08-13"
 license: Apache-2.0
 repository-code: "https://github.com/redrob-labs/redrob-eval"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 10fd7c6..ecb60a5 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -184,6 +184,15 @@ happen and the branch is just `develop` under another name.
 in the root, `apps/web`, `packages/harness` and `packages/tokenizers` `package.json`, plus
 `version:` in `CITATION.cff`.
 
+Those five are the whole list because the workspaces depend on each other by `"*"` rather than by
+an exact version. Do not pin them: 0.2.0 shipped with `@redrob/harness` still asked for at
+`0.1.0`, so `yarn install --frozen-lockfile` looked for a private package on npm and every CI job
+failed, while a local install kept working because `node_modules` was already linked. Nothing here
+is published, so an exact internal pin only adds a second place to remember.
+
+**Run `yarn install --frozen-lockfile` on the release branch** before merging, in a clean checkout
+rather than in your working tree. It is the one check that sees a version bump the way CI does.
+
 **QA happens in three layers, and only the first two are automated.**
 
 1. *Every pull request into `develop`* runs both workflows: typecheck, lint, the `verify:*`
diff --git a/apps/web/package.json b/apps/web/package.json
index 693f06c..71fdc62 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@redrob/web",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "license": "Apache-2.0",
   "author": "Janghoon Lee",
@@ -11,7 +11,7 @@
     "lint": "eslint"
   },
   "dependencies": {
-    "@redrob/harness": "0.1.0",
+    "@redrob/harness": "*",
     "@xterm/addon-fit": "^0.10",
     "@xterm/xterm": "^5",
     "clsx": "2.1.1",
diff --git a/package.json b/package.json
index 5db9c57..1ef6c1b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "redrob-eval",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "license": "Apache-2.0",
   "author": "Janghoon Lee",
diff --git a/packages/harness/package.json b/packages/harness/package.json
index 4ac56c8..c99c164 100644
--- a/packages/harness/package.json
+++ b/packages/harness/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@redrob/harness",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "license": "Apache-2.0",
   "author": "Janghoon Lee",
@@ -15,7 +15,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@redrob/tokenizers": "0.1.0"
+    "@redrob/tokenizers": "*"
   },
   "devDependencies": {
     "@types/node": "^20",
diff --git a/packages/tokenizers/package.json b/packages/tokenizers/package.json
index 4132377..99ca442 100644
--- a/packages/tokenizers/package.json
+++ b/packages/tokenizers/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@redrob/tokenizers",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "license": "Apache-2.0",
   "author": "Janghoon Lee",