diff --git a/.github/workflows/deploy-to-firebase.yml b/.github/workflows/deploy-to-firebase.yml
index 938ef736..be5c29e5 100644
--- a/.github/workflows/deploy-to-firebase.yml
+++ b/.github/workflows/deploy-to-firebase.yml
@@ -58,6 +58,7 @@ jobs:
         env:
           DMV_USE_GIT: ${{ steps.dmv.outputs.use_git }}
           DMV_REF: ${{ steps.dmv.outputs.ref }}
+          DMV_SHA: ${{ steps.dmv.outputs.sha }}
         run: |
           set -euo pipefail
           if [ "${DMV_USE_GIT}" = "true" ]; then
@@ -68,6 +69,19 @@ jobs:
                 ;;
             esac
             pnpm pkg set 'dependencies["dicom-microscopy-viewer"]'"=github:ImagingDataCommons/dicom-microscopy-viewer#${DMV_REF}"
+            # Dynamically allow builds for the resolved tarball URL so pnpm's
+            # dependency status check passes during `pnpm run build`
+            TARBALL_KEY="dicom-microscopy-viewer@https://codeload.github.com/ImagingDataCommons/dicom-microscopy-viewer/tar.gz/${DMV_SHA}"
+            node -e "
+              const fs = require('fs');
+              const content = fs.readFileSync('pnpm-workspace.yaml', 'utf8');
+              // Insert the tarball allowBuilds entry after 'dicom-microscopy-viewer: true'
+              const updated = content.replace(
+                /(allowBuilds:[\s\S]*?dicom-microscopy-viewer: true)/,
+                \"\$1\\n  '\" + process.argv[1] + \"': true\"
+              );
+              fs.writeFileSync('pnpm-workspace.yaml', updated);
+            " "${TARBALL_KEY}"
             pnpm install --no-frozen-lockfile --ignore-scripts
           else
             pnpm install --frozen-lockfile --ignore-scripts
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 0b235e69..692bed6f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -4,6 +4,7 @@ strictPeerDependencies: false
 allowBuilds:
   core-js: true
   core-js-pure: true
+  # For npm-published versions; git tarball URLs are added dynamically by CI
   dicom-microscopy-viewer: true
 
 overrides: