diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e487276..39edd97 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -299,6 +299,17 @@ jobs:
           git -c user.name="brevo-release-bot" \
               -c user.email="brevo-release-bot@users.noreply.github.com" \
               commit -am "chore: bump brevo to ${version}"
+
+          # changesets/action wrote ~/.netrc with the repo-scoped GITHUB_TOKEN;
+          # git would send it pre-emptively and push as github-actions[bot],
+          # which has no access to the tap (403). Remove it and wire gh in as
+          # git's credential helper so the push authenticates with $GH_TOKEN
+          # (the tap PAT) — still never landing the token in argv, the remote
+          # URL, or on-disk config. Safe: this is the job's last step and every
+          # other step authenticates via env tokens, not netrc.
+          rm -f "$HOME/.netrc"
+          gh auth setup-git --hostname github.com
+
           git push --force-with-lease origin "$branch"
 
           # Don't fail the job if a bump PR is already open (e.g. a re-run).
diff --git a/AGENTS.md b/AGENTS.md
index 5398258..dc3ae5d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -97,3 +97,23 @@ src/
 3. Strings in `src/lang/en.ts`
 4. Constants in `src/lib/constants.ts` if referenced elsewhere
 5. Tests in `src/__tests__/commands/`
+
+## Changesets — one file per branch, append don't multiply
+
+Any change to user-visible behavior needs a [changeset](https://github.com/changesets/changesets) (`.changeset/*.md`).
+
+**Keep exactly ONE pending changeset file per branch/PR.** Before creating a new one, check `.changeset/` for an existing pending changeset (any `.md` other than `README.md`):
+
+- **If one exists:** append your change details as new lines in its summary body — do NOT create a second file. If your change warrants a higher bump than the file currently declares, raise the bump level in its frontmatter (`patch` → `minor` → `major`).
+- **If none exists:** create one (via `yarn changeset`, or write the file directly) and commit it with your changes.
+
+Changeset file shape, for reference:
+
+```md
+---
+"@getbrevo/cli": patch
+---
+
+First change description.
+Second change description appended later on the same branch.
+```
diff --git a/CLAUDE.md b/CLAUDE.md
index 45a2ae9..52d6cf2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -162,6 +162,8 @@ yarn publish:packages     # publish to npm
 
 **When to add a changeset:** any PR that changes user-visible behavior (new feature, bug fix, breaking change). Run `yarn changeset` and commit the generated file with your PR.
 
+**One changeset file per branch/PR — append, don't multiply.** Before creating a new changeset, check `.changeset/` for an existing pending one (any `.md` other than `README.md`). If one exists, append your change description as new lines in its summary body instead of creating a second file, and raise the bump level in its frontmatter if your change warrants it (`patch` → `minor` → `major`). Only create a new file when none exists.
+
 **CI/CD:**
 - `.github/workflows/push.yaml` — runs lint, test, build on every push/PR to `main`
 - `.github/workflows/release.yaml` — when changesets merge to `main`, opens a "Version Packages" PR; merging that PR publishes to npm