diff --git a/CHANGELOG.md b/CHANGELOG.md
index e508735..e115378 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -147,6 +147,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **setup-env retries uv install on transient GitHub Releases download failures** ([#407](https://github.com/vig-os/devcontainer/issues/407))
   - Add `continue-on-error` plus a delayed second attempt for `astral-sh/setup-uv` in `.github/actions/setup-env/action.yml`
   - Reduce flaky release publish failures when GitHub CDN returns transient HTTP errors for uv release assets
+- **Smoke-test deploy keeps workspace scaffold as root CHANGELOG** ([#403](https://github.com/vig-os/devcontainer/issues/403))
+  - Stop overwriting `CHANGELOG.md` with a minimal stub in `assets/smoke-test/.github/workflows/repository-dispatch.yml`
+  - Require the workspace `CHANGELOG.md` from `init-workspace` so downstream `prepare-release` validation matches shipped layout
+  - When the first changelog section is `## [X.Y.Z] - …` (TBD or a release date), remap that top version header to `## Unreleased` so downstream `prepare-release` can run
 
 ### Security
 
diff --git a/assets/smoke-test/.github/workflows/repository-dispatch.yml b/assets/smoke-test/.github/workflows/repository-dispatch.yml
index 4026572..90c9412 100644
--- a/assets/smoke-test/.github/workflows/repository-dispatch.yml
+++ b/assets/smoke-test/.github/workflows/repository-dispatch.yml
@@ -211,6 +211,9 @@ jobs:
           if [ -e "CHANGELOG.md" ] && [ ! -w "CHANGELOG.md" ]; then
             NEEDS_CHOWN=true
           fi
+          if [ -e "CHANGELOG.md" ] && [ ! -r "CHANGELOG.md" ]; then
+            NEEDS_CHOWN=true
+          fi
 
           if [ "${NEEDS_CHOWN}" = "true" ]; then
             OWNER_UID_GID="$(id -u):$(id -g)"
@@ -229,15 +232,24 @@ jobs:
             echo "ERROR: .devcontainer/CHANGELOG.md is not readable after ownership repair"
             exit 1
           fi
-          cat > "CHANGELOG.md" <<CHLOG
-          # Changelog
-
-          ## Unreleased
-
-          ### Changed
-
-          - Deploy devcontainer ${TAG}
-          CHLOG
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "ERROR: expected CHANGELOG.md after install (workspace scaffold)"
+            exit 1
+          fi
+          if [ ! -r "CHANGELOG.md" ]; then
+            echo "ERROR: CHANGELOG.md is not readable after ownership repair"
+            exit 1
+          fi
+          FIRST_CHANGELOG_SECTION="$(awk '/^## / { print; exit }' CHANGELOG.md)"
+          if [ "${FIRST_CHANGELOG_SECTION}" = "## Unreleased" ]; then
+            :
+          elif printf '%s\n' "${FIRST_CHANGELOG_SECTION}" | grep -Eq '^## \[[^]]+\] - '; then
+            echo "Remapping top ## [version] - <date> to ## Unreleased for prepare-release"
+            sed -i '0,/^## \[[^]]*\] - /s/^## \[[^]]*\] - .*/## Unreleased/' CHANGELOG.md
+          else
+            echo "ERROR: CHANGELOG.md first section is neither ## Unreleased nor ## [version] - <date>: ${FIRST_CHANGELOG_SECTION:-<empty>}"
+            exit 1
+          fi
 
       - name: Prepare deploy branch and metadata
         id: prepare_branch
diff --git a/assets/workspace/.devcontainer/CHANGELOG.md b/assets/workspace/.devcontainer/CHANGELOG.md
index e508735..e115378 100644
--- a/assets/workspace/.devcontainer/CHANGELOG.md
+++ b/assets/workspace/.devcontainer/CHANGELOG.md
@@ -147,6 +147,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **setup-env retries uv install on transient GitHub Releases download failures** ([#407](https://github.com/vig-os/devcontainer/issues/407))
   - Add `continue-on-error` plus a delayed second attempt for `astral-sh/setup-uv` in `.github/actions/setup-env/action.yml`
   - Reduce flaky release publish failures when GitHub CDN returns transient HTTP errors for uv release assets
+- **Smoke-test deploy keeps workspace scaffold as root CHANGELOG** ([#403](https://github.com/vig-os/devcontainer/issues/403))
+  - Stop overwriting `CHANGELOG.md` with a minimal stub in `assets/smoke-test/.github/workflows/repository-dispatch.yml`
+  - Require the workspace `CHANGELOG.md` from `init-workspace` so downstream `prepare-release` validation matches shipped layout
+  - When the first changelog section is `## [X.Y.Z] - …` (TBD or a release date), remap that top version header to `## Unreleased` so downstream `prepare-release` can run
 
 ### Security
 
diff --git a/tests/bats/just.bats b/tests/bats/just.bats
index 5ebeeca..731fe1d 100644
--- a/tests/bats/just.bats
+++ b/tests/bats/just.bats
@@ -75,8 +75,8 @@ setup() {
     assert_success
 }
 
-@test "smoke-test dispatch generates minimal changelog for prepare-release freeze" {
-    run bash -lc 'grep -Fq -- "cat > \"CHANGELOG.md\" <<CHLOG" assets/smoke-test/.github/workflows/repository-dispatch.yml && grep -Fq -- "## Unreleased" assets/smoke-test/.github/workflows/repository-dispatch.yml && grep -Fq -- "- Deploy devcontainer \${TAG}" assets/smoke-test/.github/workflows/repository-dispatch.yml'
+@test "smoke-test dispatch normalizes workspace changelog for prepare-release freeze" {
+    run bash -lc 'grep -Fq -- "expected CHANGELOG.md after install (workspace scaffold)" assets/smoke-test/.github/workflows/repository-dispatch.yml && grep -Fq -- "FIRST_CHANGELOG_SECTION" assets/smoke-test/.github/workflows/repository-dispatch.yml && grep -Fq -- "## Unreleased" assets/smoke-test/.github/workflows/repository-dispatch.yml'
     assert_success
 }