diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb109042f..049c8263d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
+- **devenv/pnpm**: Keep the cached `pnpm-install-contract.json` writable after
+  copying the generated read-only contract into `.devenv/task-cache`, so repeat
+  `pnpm:install` runs can replace mutable cache state without downstream
+  chmod workarounds.
+
 - **@overeng/notion-effect-client**: Add `NotionMarkdown.markdownToBlocks`,
   an AST-based selected-GFM Markdown importer that emits Notion append/create
   block payloads for paragraphs, headings, dividers, lists, task lists, code,
diff --git a/nix/devenv-modules/tasks/shared/pnpm.nix b/nix/devenv-modules/tasks/shared/pnpm.nix
index a882a4e25..320ba8830 100644
--- a/nix/devenv-modules/tasks/shared/pnpm.nix
+++ b/nix/devenv-modules/tasks/shared/pnpm.nix
@@ -537,7 +537,9 @@ let
           echo "$_gvs_hash" > "$_gvs_hash_file"
         fi
         if [ -n "''${_pnpm_install_contract_file:-}" ]; then
+          rm -f "$contract_state_file"
           cp "$_pnpm_install_contract_file" "$contract_state_file"
+          chmod u+w "$contract_state_file" 2>/dev/null || true
           if pnpm_contract_supports_dependency_materialization_profile ${pkgs.nodejs}/bin/node "$_pnpm_install_contract_file"; then
             if [ -n "''${CI:-}" ]; then
               _dependency_materialization_trait="ciJobLocal"
diff --git a/nix/devenv-modules/tasks/shared/tests/pnpm-task-smoke.test.sh b/nix/devenv-modules/tasks/shared/tests/pnpm-task-smoke.test.sh
index 07176f50c..4bfd94ec2 100644
--- a/nix/devenv-modules/tasks/shared/tests/pnpm-task-smoke.test.sh
+++ b/nix/devenv-modules/tasks/shared/tests/pnpm-task-smoke.test.sh
@@ -388,6 +388,17 @@ echo "Test 2: exec runs fake pnpm and populates cache"
   grep -qF ".effect-utils-pnpm-store.lock" "$tmpdir/pnpm-install.exec.sh"
 )
 
+echo "Test 2b: exec rewrites read-only generated contract cache state"
+(
+  cd "$workspace"
+  export HOME="$tmpdir/home"
+  export PNPM_HOME="$workspace/.pnpm-home-a"
+  contract_state_file="$workspace/.devenv/task-cache/pnpm-install/pnpm-install-contract.json"
+  chmod a-w "$workspace/pnpm-install-contract.json" "$contract_state_file"
+  bash "$tmpdir/pnpm-install.exec.sh"
+  test -w "$contract_state_file"
+)
+
 echo "Test 3: status hits after install with same GVS path"
 (
   cd "$workspace"