diff --git a/docs/RELEASE_DEPENDENCIES.md b/docs/RELEASE_DEPENDENCIES.md
index 6ba5b57..187fb17 100644
--- a/docs/RELEASE_DEPENDENCIES.md
+++ b/docs/RELEASE_DEPENDENCIES.md
@@ -37,12 +37,12 @@ govoplan-campaign git@git.add-ideas.de:add-ideas/govoplan-campaign.git v0.1.1
 
 Local development uses `webui/package.json`, which may point at sibling module checkouts while active development is happening.
 
-Release WebUI installs should use `webui/package.release.json`. It points module dependencies at the same tagged git repositories. To generate a release lockfile, copy it over `package.json` in a release branch or build workspace and then run `npm install` there:
+Release WebUI installs should use `webui/package.release.json`. It points module dependencies at the same tagged git repositories. After the module tags referenced there exist, generate the committed release lockfile without touching the development package files:
 
 ```bash
-cd /mnt/DATA/git/govoplan-core/webui
-cp package.release.json package.json
-PATH=/home/zemion/.nvm/versions/node/v22.22.3/bin:$PATH /home/zemion/.nvm/versions/node/v22.22.3/bin/npm install
+cd /mnt/DATA/git/govoplan-core
+scripts/generate-release-lock.sh
+cd webui
 PATH=/home/zemion/.nvm/versions/node/v22.22.3/bin:$PATH /home/zemion/.nvm/versions/node/v22.22.3/bin/npm run build
 ```
 
@@ -59,6 +59,6 @@ Frontend module permutations are regression-tested through `GOVOPLAN_WEBUI_MODUL
 - Keep Python package versions, WebUI package versions, and git tags aligned.
 - Tag core, files, mail, and campaign repositories together.
 - Update `requirements-release.txt` and `webui/package.release.json` when the release tag changes.
-- Generate the committed full-product release lockfile from `package.release.json` in a clean build workspace.
+- Generate the committed full-product release lockfile from `package.release.json` with `scripts/generate-release-lock.sh`.
 - Add separate release manifest/lockfile pairs only for module compositions that are shipped as their own products.
 - Do not commit local sibling paths into release manifests.
diff --git a/scripts/generate-release-lock.sh b/scripts/generate-release-lock.sh
new file mode 100644
index 0000000..bbbd705
--- /dev/null
+++ b/scripts/generate-release-lock.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  scripts/generate-release-lock.sh [options]
+
+Generates webui/package-lock.release.json from webui/package.release.json in a
+temporary workspace. The normal development package.json and package-lock.json
+are left untouched.
+
+Run this after the module git tags referenced by package.release.json exist and
+are reachable, and before tagging the core release commit that should contain
+the regenerated release lockfile.
+
+Options:
+  --npm <path>       npm executable to use.
+  -h, --help         Show this help.
+USAGE
+}
+
+fail() {
+  echo "error: $*" >&2
+  exit 1
+}
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WEBUI="$ROOT/webui"
+NPM_BIN="${NPM:-}"
+
+if [[ -z "$NPM_BIN" ]]; then
+  if [[ -x "/home/zemion/.nvm/versions/node/v22.22.3/bin/npm" ]]; then
+    NPM_BIN="/home/zemion/.nvm/versions/node/v22.22.3/bin/npm"
+  else
+    NPM_BIN="npm"
+  fi
+fi
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --npm)
+      [[ $# -ge 2 ]] || fail "missing value for $1"
+      NPM_BIN="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+[[ -f "$WEBUI/package.release.json" ]] || fail "missing $WEBUI/package.release.json"
+command -v "$NPM_BIN" >/dev/null 2>&1 || fail "npm executable not found: $NPM_BIN"
+
+TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/govoplan-release-lock.XXXXXXXX")"
+cleanup() {
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
+
+cp "$WEBUI/package.release.json" "$TMP_DIR/package.json"
+if [[ -f "$WEBUI/package-lock.release.json" ]]; then
+  cp "$WEBUI/package-lock.release.json" "$TMP_DIR/package-lock.json"
+fi
+
+echo "Generating release lockfile from $WEBUI/package.release.json"
+echo "Temporary workspace: $TMP_DIR"
+(
+  cd "$TMP_DIR"
+  PATH="$(dirname "$NPM_BIN"):$PATH" "$NPM_BIN" install --package-lock-only --ignore-scripts
+)
+
+cp "$TMP_DIR/package-lock.json" "$WEBUI/package-lock.release.json"
+echo "Updated $WEBUI/package-lock.release.json"