diff --git a/release.toml b/release.toml
index 9fcce4e..f15374a 100644
--- a/release.toml
+++ b/release.toml
@@ -3,4 +3,12 @@ publish = true
 # Hold off pushing until tags and publish have both succeeded; `just release`
 # pushes last.
 push = false
-pre-release-hook = ["sh", "-c", "git cliff -o CHANGELOG.md --tag {{version}} && git add CHANGELOG.md"]
+# Regenerate the changelog and stage it so it lands in the release commit.
+#
+# Guarded on DRY_RUN because cargo-release runs pre-release hooks during a dry
+# run too (verified against cargo-release 1.1.5, which exports DRY_RUN=true,
+# CRATE_NAME, PREV_VERSION and NEW_VERSION to the hook). Without the guard,
+# `just release-plan` — documented as a preview that writes nothing — writes and
+# `git add`s CHANGELOG.md, and the clean-tree check in `just release` then
+# refuses to run. That check is load-bearing: publishing is irreversible.
+pre-release-hook = ["sh", "-c", '[ "$DRY_RUN" = "true" ] || (git cliff -o CHANGELOG.md --tag {{version}} && git add CHANGELOG.md)']