diff --git a/deno.lock b/.runseal/deno.lock
similarity index 100%
rename from deno.lock
rename to .runseal/deno.lock
diff --git a/.runseal/wrappers/guard.ts b/.runseal/wrappers/guard.ts
index ec35622..0e8317e 100644
--- a/.runseal/wrappers/guard.ts
+++ b/.runseal/wrappers/guard.ts
@@ -153,7 +153,7 @@ await cmd.run("deno", [
   "--config",
   ".runseal/deno.json",
   "--lock",
-  "deno.lock",
+  ".runseal/deno.lock",
   "--frozen=true",
   ".runseal/wrappers/cloudflare.ts",
   ".runseal/wrappers/guard.ts",
diff --git a/.runseal/wrappers/init.ts b/.runseal/wrappers/init.ts
index 725e5dc..9a75544 100644
--- a/.runseal/wrappers/init.ts
+++ b/.runseal/wrappers/init.ts
@@ -85,12 +85,12 @@ for (
   const path of [
     "Cargo.toml",
     "Cargo.lock",
-    "deno.lock",
     "flavor.toml",
     "manage.sh",
     "manage.ps1",
     "runseal.toml",
     ".runseal/deno.json",
+    ".runseal/deno.lock",
     ".runseal/hooks/pre-commit",
     ".runseal/hooks/commit-msg",
     ".runseal/lib/cli.ts",
diff --git a/Cargo.lock b/Cargo.lock
index 1a4d3c8..38a76a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -980,7 +980,7 @@ dependencies = [
 
 [[package]]
 name = "runseal"
-version = "0.9.0"
+version = "0.10.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
diff --git a/README.md b/README.md
index 19f3d23..46af636 100644
--- a/README.md
+++ b/README.md
@@ -272,7 +272,7 @@ Declare the policy in the selected profile:
 ```toml
 [deno]
 config = ".runseal/deno.json"
-lock = "deno.lock"
+lock = ".runseal/deno.lock"
 permissions = [
   "--allow-read=.",
   "--allow-write=.",
diff --git a/app/Cargo.toml b/app/Cargo.toml
index fa35f64..a78d90b 100644
--- a/app/Cargo.toml
+++ b/app/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "runseal"
-version = "0.9.0"
+version = "0.10.0"
 edition = "2024"
 
 [dependencies]
diff --git a/app/tests/internal_wrappers.rs b/app/tests/internal_wrappers.rs
index c9bbe29..81e9f9b 100644
--- a/app/tests/internal_wrappers.rs
+++ b/app/tests/internal_wrappers.rs
@@ -72,7 +72,7 @@ root = ".resource"
 
 [deno]
 config = ".runseal/deno.json"
-lock = "deno.lock"
+lock = ".runseal/deno.lock"
 permissions = ["--allow-env"]
 "#,
     )
@@ -231,7 +231,7 @@ fn deno_uses_profile_policy() {
     assert!(log.contains("--config"));
     assert!(log.contains(".runseal/deno.json"));
     assert!(log.contains("--lock"));
-    assert!(log.contains("deno.lock"));
+    assert!(log.contains(".runseal/deno.lock"));
     assert!(log.contains("--frozen=true"));
     assert!(log.contains("--allow-env"));
     assert!(log.contains("hello world"));
diff --git a/app/tests/operator/init.rs b/app/tests/operator/init.rs
index 6628d21..1e1f3f1 100644
--- a/app/tests/operator/init.rs
+++ b/app/tests/operator/init.rs
@@ -44,12 +44,12 @@ fn write_required_files(project: &Path) {
     for path in [
         "Cargo.toml",
         "Cargo.lock",
-        "deno.lock",
         "flavor.toml",
         "manage.sh",
         "manage.ps1",
         "runseal.toml",
         ".runseal/deno.json",
+        ".runseal/deno.lock",
         ".runseal/hooks/pre-commit",
         ".runseal/hooks/commit-msg",
         ".runseal/lib/cli.ts",
@@ -91,8 +91,8 @@ fn write_required_files(project: &Path) {
         std::fs::write(&file, "").expect("required file should be written");
     }
     std::fs::write(
-        project.join("deno.lock"),
-        std::fs::read_to_string(repo_root().join("deno.lock"))
+        project.join(".runseal/deno.lock"),
+        std::fs::read_to_string(repo_root().join(".runseal/deno.lock"))
             .expect("repo deno lock should be readable"),
     )
     .expect("deno lock should be copied");
diff --git a/runseal.toml b/runseal.toml
index 2893cc8..3301df1 100644
--- a/runseal.toml
+++ b/runseal.toml
@@ -3,7 +3,7 @@ root = ".local"
 
 [deno]
 config = ".runseal/deno.json"
-lock = "deno.lock"
+lock = ".runseal/deno.lock"
 permissions = [
   "--allow-read=.",
   "--allow-write=.",