diff --git a/bun.lock b/bun.lock
index 3b083d3e2..059029aa2 100644
--- a/bun.lock
+++ b/bun.lock
@@ -1,6 +1,5 @@
 {
   "lockfileVersion": 1,
-  "configVersion": 1,
   "workspaces": {
     "": {
       "name": "openpost",
@@ -234,6 +233,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",
@@ -2644,7 +2644,7 @@
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="],
+    "qs": ["qs@6.16.0", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="],
 
     "query-selector-shadow-dom": ["query-selector-shadow-dom@1.0.1", "", {}, "sha512-lT5yCqEBgfoMYpf3F2xQRK7zEr1rhIIZuceDK6+xRkJQ4NMbHTwXqk4NkwDwQMNqXgG9r9fyHnzwNVs6zV5KRw=="],
 
diff --git a/changes/ci-surface-planning.md b/changes/ci-surface-planning.md
index 633da720b..1a7f22a7f 100644
--- a/changes/ci-surface-planning.md
+++ b/changes/ci-surface-planning.md
@@ -1,8 +1,4 @@
 ### Changed
 
-- CI now runs the full release-candidate matrix for release tags instead of
-  every push to `main`. Main pushes plan from the pushed diff, so untouched
-  surfaces (for example the Android candidate) skip their jobs, and the release
-  workflow waits for the tag's own CI run before promoting its artifacts.
-- Backend tests run once with the race detector and coverage together instead
-  of as two separate suites.
+- CI now runs the full release-candidate matrix for release tags instead of every push to `main`. Main pushes plan from the pushed diff, so untouched surfaces (for example the Android candidate) skip their jobs, and the release workflow waits for the tag's own CI run before promoting its artifacts.
+- Backend tests run once with the race detector and coverage together instead of as two separate suites.
diff --git a/package.json b/package.json
index fc79f5635..8f5355f13 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",