diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cbf6eaa4..42803702 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -227,6 +227,7 @@ jobs:
           E2E_PASSWORD: password123
 
       - name: Open / update screenshots PR
+        id: create-pr
         uses: peter-evans/create-pull-request@v6
         with:
           token: ${{ secrets.DOCS_REPO_TOKEN }}
@@ -237,6 +238,15 @@ jobs:
           add-paths: docs/images/
           delete-branch: true
 
+      - name: Auto-merge screenshots PR
+        if: steps.create-pr.outputs.pull-request-number != ''
+        env:
+          GH_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }}
+        run: |
+          gh pr merge ${{ steps.create-pr.outputs.pull-request-number }} \
+            --auto --squash \
+            --repo ${{ github.repository }}
+
   sync-docs:
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 9611caf9..767e9372 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,6 +15,9 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # GITHUB_TOKEN cannot trigger other workflows (GitHub security restriction).
+          # Using DOCS_REPO_TOKEN (PAT) ensures the tag push from release-please
+          # cascades to docker-publish.yml and publishes to Docker Hub.
+          token: ${{ secrets.DOCS_REPO_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c6957fd..fe04dfb1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- **fix(editor):** Monaco editor stuck on "Loading…" — `@monaco-editor/react` was fetching Monaco's loader from `cdn.jsdelivr.net` at runtime, which the Helmet CSP (`scriptSrc: 'self'`) correctly blocked. Fixed by configuring `loader.config({ monaco })` in `main.tsx` to use the locally bundled `monaco-editor` npm package and wiring a Vite `?worker` blob URL for the editor worker — no CDN requests, no CSP changes needed.
+- **fix(ci):** `release-please.yml` used `GITHUB_TOKEN` to create release tags — GitHub's security model prevents `GITHUB_TOKEN`-triggered events from cascading to other workflow runs, so `docker-publish.yml` never fired after a release. Switched to `DOCS_REPO_TOKEN` (PAT) so tag creation correctly triggers the Docker Hub publish workflow.
+- **fix(ci):** Screenshot refresh PR now auto-merges via `gh pr merge --auto --squash` after `peter-evans/create-pull-request` creates it — no more manual merge required on every `develop` push.
+
 ### Fixed
 - **fix(ci):** `docker-publish.yml` was triggered by `release: types: [published]` (GitHub Release event) instead of `push: tags: v*` — pushing a git tag never fired the workflow. Changed trigger to `push: tags: v*` and updated `enable` conditions from `github.event_name == 'release'` to `startsWith(github.ref, 'refs/tags/v')` so any `v*` tag push automatically builds and publishes `latest` + semver tags to Docker Hub without requiring a manual GitHub Release.
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3f712d39..1db2b3f7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -33,6 +33,7 @@
         "cmdk": "^1.1.1",
         "geist": "^1.7.0",
         "lucide-react": "^0.575.0",
+        "monaco-editor": "^0.55.1",
         "motion": "^12.38.0",
         "next-themes": "^0.4.6",
         "radix-ui": "^1.4.3",
diff --git a/frontend/package.json b/frontend/package.json
index e592b70a..d3a96883 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -35,6 +35,7 @@
     "cmdk": "^1.1.1",
     "geist": "^1.7.0",
     "lucide-react": "^0.575.0",
+    "monaco-editor": "^0.55.1",
     "motion": "^12.38.0",
     "next-themes": "^0.4.6",
     "radix-ui": "^1.4.3",
diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx
index a7fa8ce9..6ec4fa01 100644
--- a/frontend/src/main.tsx
+++ b/frontend/src/main.tsx
@@ -3,6 +3,20 @@ import { createRoot } from 'react-dom/client'
 import './index.css'
 import App from './App.tsx'
 import ErrorBoundary from './components/ErrorBoundary.tsx'
+import * as monaco from 'monaco-editor'
+import { loader } from '@monaco-editor/react'
+import editorWorker from 'monaco-editor/esm/vs/editor/editor.worker?worker'
+
+// Use the locally bundled Monaco instead of fetching from cdn.jsdelivr.net.
+// The CSP (scriptSrc: 'self') blocks external CDN scripts; bundling avoids
+// that entirely. Sencho only needs YAML/plaintext so the base editorWorker
+// covers all language modes — no additional language workers required.
+window.MonacoEnvironment = {
+  getWorker(_workerId: string, _label: string): Worker {
+    return new editorWorker()
+  },
+}
+loader.config({ monaco })
 
 createRoot(document.getElementById('root')!).render(
   <StrictMode>