diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml
index 37d42a5..e7c3835 100644
--- a/.github/workflows/semantic-release.yml
+++ b/.github/workflows/semantic-release.yml
@@ -33,6 +33,9 @@ jobs:
 
       - name: Release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # NPM_TOKEN: ${{ secrets.NPM_TOKEN }}  # uncomment when ready to publish to npm
+          # GH_TOKEN must be a PAT with repo + workflow scopes so @semantic-release/git
+          # can push the version bump commit back to the protected main branch.
+          # Create at: github.com/settings/tokens → Classic → repo + workflow scopes
+          # Add as secret: github.com/RustMunkey/maschina/settings/secrets/actions
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
         run: pnpm exec semantic-release
diff --git a/.releaserc.json b/.releaserc.json
index fac87e3..66f80f1 100644
--- a/.releaserc.json
+++ b/.releaserc.json
@@ -14,8 +14,7 @@
           { "type": "chore", "release": false },
           { "type": "ci", "release": false },
           { "type": "test", "release": false },
-          { "type": "release", "release": "major" },
-          { "breaking": true, "release": "minor" }
+          { "breaking": true, "release": "major" }
         ]
       }
     ],
@@ -33,18 +32,24 @@
         }
       }
     ],
+    ["@semantic-release/changelog", { "changelogFile": "CHANGELOG.md" }],
     [
-      "@semantic-release/changelog",
-      {
-        "changelogFile": "CHANGELOG.md"
-      }
+      "@semantic-release/exec",
+      { "prepareCmd": "bash scripts/sync-versions.sh ${nextRelease.version}" }
     ],
     [
-      "@semantic-release/github",
+      "@semantic-release/git",
       {
-        "successComment": false,
-        "failComment": false
+        "assets": [
+          "CHANGELOG.md",
+          "package.json",
+          "packages/*/package.json",
+          "services/*/package.json",
+          "apps/*/package.json"
+        ],
+        "message": "chore(release): ${nextRelease.version} [skip ci]"
       }
-    ]
+    ],
+    ["@semantic-release/github", { "successComment": false, "failComment": false }]
   ]
 }
diff --git a/package.json b/package.json
index 5af7632..bd76503 100644
--- a/package.json
+++ b/package.json
@@ -187,6 +187,8 @@
     "@discordjs/rest": "^2.6.1",
     "@irys/sdk": "^0.2.11",
     "@semantic-release/changelog": "^6",
+    "@semantic-release/exec": "^6",
+    "@semantic-release/git": "^10",
     "@semantic-release/github": "^10",
     "@types/node": "^22",
     "@vitest/coverage-v8": "^4.0.18",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1290e2e..908f570 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -33,6 +33,12 @@ importers:
       '@semantic-release/changelog':
         specifier: ^6
         version: 6.0.3(semantic-release@24.2.9(typescript@5.9.3))
+      '@semantic-release/exec':
+        specifier: ^6
+        version: 6.0.3(semantic-release@24.2.9(typescript@5.9.3))
+      '@semantic-release/git':
+        specifier: ^10
+        version: 10.0.1(semantic-release@24.2.9(typescript@5.9.3))
       '@semantic-release/github':
         specifier: ^10
         version: 10.3.5(semantic-release@24.2.9(typescript@5.9.3))
@@ -6210,6 +6216,18 @@ packages:
     resolution: {integrity: sha512-mgdxrHTLOjOddRVYIYDo0fR3/v61GNN1YGkfbrjuIKg/uMgCd+Qzo3UAXJ+woLQQpos4pl5Esuw5A7AoNlzjUQ==}
     engines: {node: '>=18'}
 
+  '@semantic-release/exec@6.0.3':
+    resolution: {integrity: sha512-bxAq8vLOw76aV89vxxICecEa8jfaWwYITw6X74zzlO0mc/Bgieqx9kBRz9z96pHectiTAtsCwsQcUyLYWnp3VQ==}
+    engines: {node: '>=14.17'}
+    peerDependencies:
+      semantic-release: '>=18.0.0'
+
+  '@semantic-release/git@10.0.1':
+    resolution: {integrity: sha512-eWrx5KguUcU2wUPaO6sfvZI0wPafUKAMNC18aXY4EnNcrZL86dEmpNVnC9uMpGZkmZJ9EfCVJBQx4pV4EMGT1w==}
+    engines: {node: '>=14.17'}
+    peerDependencies:
+      semantic-release: '>=18.0.0'
+
   '@semantic-release/github@10.3.5':
     resolution: {integrity: sha512-svvRglGmvqvxjmDgkXhrjf0lC88oZowFhOfifTldbgX9Dzj0inEtMLaC+3/MkDEmxmaQjWmF5Q/0CMIvPNSVdQ==}
     engines: {node: '>=20.8.1'}
@@ -10651,6 +10669,10 @@ packages:
     resolution: {integrity: sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==}
     engines: {node: '>=18'}
 
+  p-reduce@2.1.0:
+    resolution: {integrity: sha512-2USApvnsutq8uoxZBGbbWM0JIYLiEMJ9RlaN7fAzVNb9OZN0SHjjTTfIcb667XynS5Y1VhwDJVDa72TnPzAYWw==}
+    engines: {node: '>=8'}
+
   p-reduce@3.0.0:
     resolution: {integrity: sha512-xsrIUgI0Kn6iyDYm9StOpOeK29XM1aboGji26+QEortiFST1hGZaUQOLhtEbqHErPpGW/aSz6allwK2qcptp0Q==}
     engines: {node: '>=12'}
@@ -18677,6 +18699,32 @@ snapshots:
 
   '@semantic-release/error@4.0.0': {}
 
+  '@semantic-release/exec@6.0.3(semantic-release@24.2.9(typescript@5.9.3))':
+    dependencies:
+      '@semantic-release/error': 3.0.0
+      aggregate-error: 3.1.0
+      debug: 4.4.3
+      execa: 5.1.1
+      lodash: 4.17.23
+      parse-json: 5.2.0
+      semantic-release: 24.2.9(typescript@5.9.3)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@semantic-release/git@10.0.1(semantic-release@24.2.9(typescript@5.9.3))':
+    dependencies:
+      '@semantic-release/error': 3.0.0
+      aggregate-error: 3.1.0
+      debug: 4.4.3
+      dir-glob: 3.0.1
+      execa: 5.1.1
+      lodash: 4.17.23
+      micromatch: 4.0.8
+      p-reduce: 2.1.0
+      semantic-release: 24.2.9(typescript@5.9.3)
+    transitivePeerDependencies:
+      - supports-color
+
   '@semantic-release/github@10.3.5(semantic-release@24.2.9(typescript@5.9.3))':
     dependencies:
       '@octokit/core': 6.1.6
@@ -23943,6 +23991,8 @@ snapshots:
 
   p-map@7.0.4: {}
 
+  p-reduce@2.1.0: {}
+
   p-reduce@3.0.0: {}
 
   p-timeout@6.1.4: {}
diff --git a/scripts/sync-versions.sh b/scripts/sync-versions.sh
new file mode 100644
index 0000000..ad3e842
--- /dev/null
+++ b/scripts/sync-versions.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# sync-versions.sh <version>
+# Updates every package.json version field in the monorepo.
+# Called by semantic-release via @semantic-release/exec.
+set -euo pipefail
+
+VERSION="${1:?version argument required}"
+
+echo "Syncing all package versions to $VERSION..."
+
+find . -name "package.json" \
+  -not -path "*/node_modules/*" \
+  -not -path "*/.git/*" \
+  -not -path "*/target/*" \
+  | while read -r file; do
+    if jq -e '.version' "$file" > /dev/null 2>&1; then
+      tmp=$(mktemp)
+      jq --arg v "$VERSION" '.version = $v' "$file" > "$tmp" && mv "$tmp" "$file"
+      echo "  $file → $VERSION"
+    fi
+  done
+
+echo "Done."