diff --git a/bun.lock b/bun.lock
index 3b083d3e..059029aa 100644
--- a/bun.lock
+++ b/bun.lock
@@ -1,6 +1,5 @@
 {
   "lockfileVersion": 1,
-  "configVersion": 1,
   "workspaces": {
     "": {
       "name": "openpost",
@@ -234,6 +233,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",
@@ -2644,7 +2644,7 @@
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="],
+    "qs": ["qs@6.16.0", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="],
 
     "query-selector-shadow-dom": ["query-selector-shadow-dom@1.0.1", "", {}, "sha512-lT5yCqEBgfoMYpf3F2xQRK7zEr1rhIIZuceDK6+xRkJQ4NMbHTwXqk4NkwDwQMNqXgG9r9fyHnzwNVs6zV5KRw=="],
 
diff --git a/changes/ci-surface-planning.md b/changes/ci-surface-planning.md
index 633da720..1a7f22a7 100644
--- a/changes/ci-surface-planning.md
+++ b/changes/ci-surface-planning.md
@@ -1,8 +1,4 @@
 ### Changed
 
-- CI now runs the full release-candidate matrix for release tags instead of
-  every push to `main`. Main pushes plan from the pushed diff, so untouched
-  surfaces (for example the Android candidate) skip their jobs, and the release
-  workflow waits for the tag's own CI run before promoting its artifacts.
-- Backend tests run once with the race detector and coverage together instead
-  of as two separate suites.
+- CI now runs the full release-candidate matrix for release tags instead of every push to `main`. Main pushes plan from the pushed diff, so untouched surfaces (for example the Android candidate) skip their jobs, and the release workflow waits for the tag's own CI run before promoting its artifacts.
+- Backend tests run once with the race detector and coverage together instead of as two separate suites.
diff --git a/package.json b/package.json
index fc79f563..8f5355f1 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",