diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e28cdf2..34bbd0cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -568,6 +568,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Installs without the development dependencies work again (`uv tool install`
+  from a checkout, and any install from a built wheel). Two things broke
+  them: `tree-sitter-language-pack` 1.6.3, the newest release the old
+  `<1.8` cap allowed, installs without an importable module, so every audit
+  crashed while loading controls; and `packaging`, which darnit-core imports
+  directly and through `celpy.c7nlib`, was not declared (#441), so every
+  control with an `expr` was `ERROR`. The cap is now `<1.6.3` and `packaging`
+  is a declared dependency.
 - An audit evaluates only its own framework's controls. A long-lived process
   such as the MCP server used to evaluate every control an earlier audit had
   registered, so auditing `reproducibility` after `openssf-baseline` returned
diff --git a/CLAUDE.md b/CLAUDE.md
index 5db66a5a..c2d7e136 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -386,7 +386,7 @@ else:
 ## Active Technologies
 - Python 3.11/3.12 (workspace targets) plus bash for release scripts and GitHub Actions YAML + `shiv` (binary builder), `cosign` (image + binary signing), `syft` (SBOM generation), `docker buildx` (multi-arch images), `gh` CLI (release creation), Sigstore-action (PyPI wheel signing via `pypa/gh-action-pypi-publish`). No new runtime dependencies in any darnit Python package. (012-packaging-distribution)
 - External release surfaces only — PyPI, TestPyPI, GHCR, GitHub Releases (binary assets + attestations), `kusari-oss/homebrew-tap` repo (formula). Repo itself stores only build configs and workflow definitions. (012-packaging-distribution)
-- Python 3.11/3.12 (workspace targets — same as the rest of darnit) + `pydantic >= 2.0` (already used for `FrameworkConfig`); `packaging` for PEP 440 `SpecifierSet` (declared by `darnit-reproducibility` as of feature 037; darnit-core imports it at runtime without declaring it, which is tracked separately). `tomllib` from stdlib for TOML parsing. No new runtime dependencies. (013-plugin-composition)
+- Python 3.11/3.12 (workspace targets — same as the rest of darnit) + `pydantic >= 2.0` (already used for `FrameworkConfig`); `packaging` for PEP 440 `SpecifierSet` (declared by `darnit-core` and, as of feature 037, by `darnit-reproducibility`). `tomllib` from stdlib for TOML parsing. No new runtime dependencies. (013-plugin-composition)
 - Filesystem only. Composition is resolved in-memory at framework-config load time; no new persistent state. (013-plugin-composition)
 - Python 3.11/3.12 (workspace targets) + `tomllib` (stdlib), `pydantic >= 2` (existing; `extra="forbid"` for the new models). No new runtime dependencies: per-user config location extends the existing `darnit/stores/defaults/platform_paths.py`; repository-identity normalization is a small in-tree helper. (040-operator-config-trust)
 - Filesystem only. Operator configuration: one TOML file per user (research R1). Confirmations: a file under the existing darnit data root, keyed by canonical repository identity (research R6). Project assertions: `.project/darnit.yaml` in the audited repository (read-only input). (040-operator-config-trust)
diff --git a/packages/darnit-baseline/pyproject.toml b/packages/darnit-baseline/pyproject.toml
index c1a363f2..7f1ad39d 100644
--- a/packages/darnit-baseline/pyproject.toml
+++ b/packages/darnit-baseline/pyproject.toml
@@ -29,7 +29,9 @@ dependencies = [
     #      separate parse_bytes() for the old contract.
     #   2. tree.root_node became a callable method instead of a property.
     # Cap at <1.8 until darnit's parsing layer supports both shapes. See #268.
-    "tree-sitter-language-pack>=1.5,<1.8",
+    # 1.6.3 installs without an importable tree_sitter_language_pack module
+    # (seen on Linux x86_64, Python 3.12), so stop below it too.
+    "tree-sitter-language-pack>=1.5,<1.6.3",
 ]
 
 [project.urls]
diff --git a/packages/darnit/pyproject.toml b/packages/darnit/pyproject.toml
index 71feb09f..c5cc6f03 100644
--- a/packages/darnit/pyproject.toml
+++ b/packages/darnit/pyproject.toml
@@ -32,6 +32,10 @@ dependencies = [
     "ruamel.yaml>=0.18.0",  # For .project/ round-trip YAML parsing
     "jinja2>=3.1.0",  # Template rendering for remediation files
     "cel-python>=0.5.0",  # CEL expression evaluation for pass logic
+    # PEP 440 version constraints in core/composition.py and
+    # config/framework_schema.py. celpy.c7nlib imports it too, and cel-python
+    # does not declare it.
+    "packaging>=23.0",
     "tomli>=2.0.0;python_version<'3.11'",
     "tomllib-stubs>=0.1.0;python_version<'3.11'",
     # RFC-0001 Stage 1 (feature 025): default LLMStep implementation. Required
diff --git a/packages/darnit/src/darnit/config/framework_schema.py b/packages/darnit/src/darnit/config/framework_schema.py
index be6d8eb1..56293a87 100644
--- a/packages/darnit/src/darnit/config/framework_schema.py
+++ b/packages/darnit/src/darnit/config/framework_schema.py
@@ -1398,8 +1398,8 @@ def _validate_version_constraint_syntax(cls, v: str | None) -> str | None:
         if v is None:
             return v
         try:
-            # Imported lazily; `packaging` is a transitive dep via setuptools
-            # and is already part of every Python install with pip available.
+            # Imported lazily; `packaging` is a declared dependency of
+            # darnit-core (see packages/darnit/pyproject.toml).
             from packaging.specifiers import SpecifierSet
 
             SpecifierSet(v)
diff --git a/uv.lock b/uv.lock
index 2b868922..5ee88fcc 100644
--- a/uv.lock
+++ b/uv.lock
@@ -477,7 +477,7 @@ dependencies = [
 requires-dist = [
     { name = "darnit-core", editable = "packages/darnit" },
     { name = "tree-sitter", specifier = ">=0.25" },
-    { name = "tree-sitter-language-pack", specifier = ">=1.5,<1.8" },
+    { name = "tree-sitter-language-pack", specifier = ">=1.5,<1.6.3" },
 ]
 
 [[package]]
@@ -488,6 +488,7 @@ dependencies = [
     { name = "cel-python" },
     { name = "jinja2" },
     { name = "mcp" },
+    { name = "packaging" },
     { name = "pydantic", extra = ["email"] },
     { name = "pydantic-ai-slim", extra = ["anthropic"] },
     { name = "pyyaml" },
@@ -509,6 +510,7 @@ requires-dist = [
     { name = "in-toto-attestation", marker = "extra == 'attestation'", specifier = ">=0.9.0" },
     { name = "jinja2", specifier = ">=3.1.0" },
     { name = "mcp", specifier = ">=1.23.0,<2" },
+    { name = "packaging", specifier = ">=23.0" },
     { name = "pydantic", specifier = ">=2.0.0" },
     { name = "pydantic", extras = ["email"], specifier = ">=2.0.0" },
     { name = "pydantic-ai-slim", extras = ["anthropic"], specifier = ">=0.0.14" },