diff --git a/CLAUDE.md b/CLAUDE.md
index e6ac894..5ccbede 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -60,7 +60,7 @@ When a component renders different things depending on a condition, return early
 ## atproto spaces alpha
 
 - The spaces SDK is the `@atproto/*` packages at `0.0.0-spaces-alpha-*` versions. Pin exact versions, since breaking changes land without notice.
-- These packages only install with pnpm. Every `@atproto/*` package with an alpha release must be pinned to the exact same alpha version through `pnpm.overrides`. A range like `^0.0.0-spaces-alpha-*` also matches the plain `0.0.0` releases, which were published broken.
+- These packages only install with pnpm. Every `@atproto/*` package with an alpha release must be pinned to the exact same alpha version through `overrides` in `pnpm-workspace.yaml`. A range like `^0.0.0-spaces-alpha-*` also matches the plain `0.0.0` releases, which were published broken.
 - Reference material: the permissioned data proposal (`bluesky-social/proposals`, `0016-permissioned-data`), the `permissioned-data-alpha` branch of `bluesky-social/atproto`, and the `bluesky-social/bulletin` example app.
 
 ## Server build-out notes
diff --git a/package.json b/package.json
index 32e4f09..5055a65 100644
--- a/package.json
+++ b/package.json
@@ -30,59 +30,6 @@
     "typescript": "7.0.2",
     "vitest": "5.0.2"
   },
-  "pnpm": {
-    "overrides": {
-      "@atproto/api": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/aws": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/bsky": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/bsync": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/car": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/common": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/common-web": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/crypto": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/dev-env": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/did": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/identity": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-builder": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-cbor": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-cli": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-client": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-data": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-document": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-installer": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-json": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-password-session": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-resolver": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-schema": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lex-server": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lexicon": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/lexicon-resolver": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-client": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-client-browser": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-client-browser-example": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-client-expo": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-client-node": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-provider": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-provider-api": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-provider-ui": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-scopes": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/oauth-types": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/ozone": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/pds": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/repo": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/space": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/sync": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/syntax": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/tap": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/xrpc": "0.0.0-spaces-alpha-20261001173819",
-      "@atproto/xrpc-server": "0.0.0-spaces-alpha-20261001173819"
-    },
-    "onlyBuiltDependencies": [
-      "better-sqlite3",
-      "esbuild"
-    ]
-  },
   "dependencies": {
     "@scn-chat/plugin-anthropic": "workspace:*",
     "@scn-chat/plugin-api": "workspace:*",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 868fa4e..2aed24f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -2,3 +2,54 @@ packages:
   - packages/*
   - apps/*
   - plugins/*
+
+allowBuilds:
+  better-sqlite3: true
+  esbuild: true
+
+overrides:
+  '@atproto/api': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/aws': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/bsky': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/bsync': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/car': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/common': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/common-web': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/crypto': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/dev-env': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/did': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/identity': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-builder': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-cbor': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-cli': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-client': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-data': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-document': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-installer': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-json': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-password-session': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-resolver': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-schema': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lex-server': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lexicon': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/lexicon-resolver': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-client': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-client-browser': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-client-browser-example': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-client-expo': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-client-node': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-provider': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-provider-api': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-provider-ui': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-scopes': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/oauth-types': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/ozone': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/pds': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/repo': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/space': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/sync': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/syntax': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/tap': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/xrpc': 0.0.0-spaces-alpha-20261001173819
+  '@atproto/xrpc-server': 0.0.0-spaces-alpha-20261001173819
diff --git a/specs/foundation.md b/specs/foundation.md
index 891db38..f8431ad 100644
--- a/specs/foundation.md
+++ b/specs/foundation.md
@@ -33,7 +33,7 @@ The plugin API package and the `plugins/` directory are created by the plugins s
 
 ### atproto alpha packages
 
-Every `@atproto/*` package with an alpha release is pinned to one exact alpha version through `pnpm.overrides` in the root `package.json`. A range like `^0.0.0-spaces-alpha-*` also matches the broken `0.0.0` releases, so ranges are never used. The lockfile is committed. Upgrading the alpha means changing one version string for every override at once.
+Every `@atproto/*` package with an alpha release is pinned to one exact alpha version through `overrides` in `pnpm-workspace.yaml`. A range like `^0.0.0-spaces-alpha-*` also matches the broken `0.0.0` releases, so ranges are never used. The lockfile is committed. Upgrading the alpha means changing one version string for every override at once.
 
 ### Lexicon package