diff --git a/CLAUDE.md b/CLAUDE.md
index d4fb07b004d..a558551d836 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,6 +23,7 @@ One GitHub release `agenthits-vX.Y.Z` covers a batch of work, not a single PR (o
 
 - Held packages stay pinned to exact versions (`better-auth`, `@better-auth/*`, `better-call`, `@better-fetch/fetch`, `stripe`, `@stepperize/react`, `@dokploy/trpc-openapi`) or `~` (`ssh2`), in their `package.json` and in the root `overrides`, so the workflow does not move them. Keep new holds pinned the same way.
 - Every other root override is a range `>=<fixed version> <next major>` (for `0.x`, `<next minor>`), so the override keeps the fixed floor and the workflow still moves the package. A security override follows the same form; an exact version there freezes the package and can silently override a newer direct dependency.
+- A package that `packages/server` and an app both declare takes the same range in both (`@trpc/server`, `undici`). With an exact version on one side and a range on the other, the daily update moves only the range and the lockfile keeps two copies; `instanceof` across them then fails, as a `TRPCError` thrown in `packages/server` did in the router tests.
 - Major updates are done by hand, one PR each (the `dokploy-upgrader` agent), with `bun add <pkg>@<ver> --minimum-release-age=86400`.
 - The one-day age is `minimumReleaseAge` in `bunfig.toml` and `MIN_RELEASE_AGE` in the workflow; change both together.
 - A commit pushed to the branch of the open PR stops its daily rebuild until the PR is merged or closed.
diff --git a/bun.lock b/bun.lock
index 434f6ae2d99..16c08129de2 100644
--- a/bun.lock
+++ b/bun.lock
@@ -238,7 +238,7 @@
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
         "@react-email/components": "^1.0.12",
-        "@trpc/server": "11.19.0",
+        "@trpc/server": "^11.19.0",
         "adm-zip": "^0.6.1",
         "ai": "^7.0.154",
         "ai-sdk-ollama": "^4.6.0",
@@ -273,7 +273,7 @@
         "slugify": "^1.6.9",
         "ssh2": "~1.16.0",
         "toml": "5.0.1",
-        "undici": "8.12.3",
+        "undici": "^8.12.3",
         "ws": "8.22.0",
         "yaml": "2.9.1",
         "zod": "^4.6.7",
diff --git a/packages/server/package.json b/packages/server/package.json
index 10388d8493a..6d0ce188a20 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -60,7 +60,7 @@
     "@oslojs/crypto": "1.0.1",
     "@oslojs/encoding": "1.1.0",
     "@react-email/components": "^1.0.12",
-    "@trpc/server": "11.19.0",
+    "@trpc/server": "^11.19.0",
     "adm-zip": "^0.6.1",
     "ai": "^7.0.154",
     "ai-sdk-ollama": "^4.6.0",
@@ -95,7 +95,7 @@
     "slugify": "^1.6.9",
     "ssh2": "~1.16.0",
     "toml": "5.0.1",
-    "undici": "8.12.3",
+    "undici": "^8.12.3",
     "ws": "8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.7"