diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88f0e2c2..b7157f93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -238,7 +238,7 @@ jobs:
           corepack enable yarn
           corepack prepare --activate yarn@4
           yarn -v
-      - name: yarn install
+      - name: Setup subject
         run: yarn install --immutable
       - name: publish to registry as "${{ env.NPMJS_RELEASE_TAG }}"
         run: >
diff --git a/tools/write-dist-manifest.cjs b/tools/write-dist-manifest.cjs
index cd96f0ff..426c93f8 100644
--- a/tools/write-dist-manifest.cjs
+++ b/tools/write-dist-manifest.cjs
@@ -22,12 +22,13 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
  * @internal
  */
 
-const { readFileSync, writeFileSync } = require('node:fs')
-const { dirname, join } = require('node:path')
+const { cpSync, readFileSync, writeFileSync } = require('node:fs')
+const { basename, dirname, join } = require('node:path')
 
 const projectRoot = join(__dirname, '..')
 
 const manifestSourceFile = join(projectRoot, 'package.json')
+const lockSourceFile = join(projectRoot, 'yarn.lock')
 
 const structuredClonePolyfill =
   typeof structuredClone === 'function'
@@ -54,7 +55,7 @@ function main (outputFile) {
   manifest.publishReplace = undefined
   // dist is expected to be a bundle - no deps need install
   manifest.dependencies = {}
-  // move deps to devDeps - for documentation purposes
+  // move deps to devDeps - for documentation purposes and release pipeline
   manifest.devDependencies = {
     ...manifestSource.dependencies,
     ...manifestSource.devDependencies,
@@ -62,8 +63,8 @@ function main (outputFile) {
 
   writeFileSync(outputFile, JSON.stringify(manifest, undefined, 2))
 
-  // also write an empty yarn.lock
-  writeFileSync(join(dirname(outputFile), 'yarn.lock'), '')
+  // also copy the original yarn.lock
+  cpSync(lockSourceFile, join(dirname(outputFile), basename(lockSourceFile)))
 }
 
 if (require.main === module) {