diff --git a/apps/collab-server/package.json b/apps/collab-server/package.json
index 6b1d68a..b19a960 100644
--- a/apps/collab-server/package.json
+++ b/apps/collab-server/package.json
@@ -9,10 +9,12 @@
     "type-check": "tsc --noEmit"
   },
   "dependencies": {
-    "@hocuspocus/server": "^2.15.0",
+    "@hocuspocus/common": "^2.15.0",
     "@hocuspocus/extension-database": "^2.15.0",
     "@hocuspocus/extension-redis": "^2.15.0",
+    "@hocuspocus/server": "^2.15.0",
     "@tasks/database": "workspace:*",
+    "drizzle-orm": "^0.38.0",
     "ioredis": "^5.4.2",
     "yjs": "^13.6.22",
     "zod": "^3.24.0"
diff --git a/apps/collab-server/src/index.ts b/apps/collab-server/src/index.ts
index c5b5b5f..af1a908 100644
--- a/apps/collab-server/src/index.ts
+++ b/apps/collab-server/src/index.ts
@@ -1,12 +1,11 @@
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { createHash } from "node:crypto";
+import { Forbidden } from "@hocuspocus/common";
 import { Database } from "@hocuspocus/extension-database";
 import { Redis as HocuspocusRedis } from "@hocuspocus/extension-redis";
 import { Hocuspocus, type Extension, type onAuthenticatePayload } from "@hocuspocus/server";
 import { db } from "@tasks/database/client";
 import { objects } from "@tasks/database/schema";
+import { eq } from "drizzle-orm";
 import IoRedis from "ioredis";
 import { z } from "zod";
 import {
@@ -15,26 +14,6 @@ import {
   yDocToBase64,
 } from "./utils.js";
 
-/**
- * Resolve transitive deps (drizzle-orm, @hocuspocus/common) without listing them in this package.
- * Uses workspace package roots so `createRequire` works under `tsx` (no `import.meta.resolve`).
- */
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const requireFromDb = createRequire(
-  join(__dirname, "../../../packages/database/package.json"),
-);
-const requireFromServer = createRequire(
-  join(__dirname, "../node_modules/@hocuspocus/server/package.json"),
-);
-
-// Resolved at runtime via @tasks/database's dependency graph (see `requireFromDb` above).
-const { eq } = requireFromDb("drizzle-orm") as {
-  eq: (...args: unknown[]) => any;
-};
-const { Forbidden } = requireFromServer("@hocuspocus/common") as {
-  Forbidden: { code: number; reason: string };
-};
-
 const contentSchema = z
   .object({
     yjs: z.string().optional(),
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1f2907e..20cd9a8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -20,6 +20,9 @@ importers:
 
   apps/collab-server:
     dependencies:
+      '@hocuspocus/common':
+        specifier: ^2.15.0
+        version: 2.15.3
       '@hocuspocus/extension-database':
         specifier: ^2.15.0
         version: 2.15.3(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)
@@ -32,6 +35,9 @@ importers:
       '@tasks/database':
         specifier: workspace:*
         version: link:../../packages/database
+      drizzle-orm:
+        specifier: ^0.38.0
+        version: 0.38.4(@opentelemetry/api@1.9.0)(@types/react@19.2.14)(postgres@3.4.8)(react@19.2.4)
       ioredis:
         specifier: ^5.4.2
         version: 5.10.1