diff --git a/lib/config.js b/lib/config.js
index 2472e733..ea438a8c 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -155,17 +155,28 @@ const getFullConfig = async ({
   // some cases. the workspaces passed in have already been run through map workspaces
   const workspacePaths = (pkgJson.workspaces || []).map(deglob)
 
+  const isPrivate = !!pkgJson.private
+  const isPublic = !isPrivate
+  const publicPkgs = pkgs.filter(p => !p.pkgJson.private)
+  const allPrivate = pkgs.every(p => p.pkgJson.private)
+
   // all derived keys
   const derived = {
     isRoot,
     isWorkspace,
+    isMono,
     // Some files are written to the base of a repo but will
     // include configuration for all packages within a monorepo
     // For these cases it is helpful to know if we are in a
     // monorepo since template-oss might be used only for
     // workspaces and not the root or vice versa.
     isRootMono,
-    isMono,
+    // public/private
+    isPublic,
+    isPrivate,
+    allPrivate,
+    // controls whether we are in a monorepo with any public workspaces
+    isMonoPublic: isMono && !!publicPkgs.filter(p => p.path !== root).length,
     // repo
     repoDir: root,
     repoFiles,
diff --git a/lib/content/index.js b/lib/content/index.js
index b08d902f..989da396 100644
--- a/lib/content/index.js
+++ b/lib/content/index.js
@@ -1,8 +1,8 @@
 const { name: NAME, version: LATEST_VERSION } = require('../../package.json')
 
-const isPublic = (p) => !p.pkg.private
+const isPublic = (p) => p.config.isPublic
 
-const sharedRoot = (name) => ({
+const sharedRootAdd = (name) => ({
   // release
   '.github/workflows/release.yml': {
     file: 'release.yml',
@@ -26,6 +26,11 @@ const sharedRoot = (name) => ({
       comment = null
     },
   },
+  // this lint commits which is only necessary for releases
+  '.github/workflows/pull-request.yml': {
+    file: 'pull-request.yml',
+    filter: isPublic,
+  },
   // ci
   '.github/matchers/tap.json': 'tap.json',
   [`.github/workflows/ci${name ? `-${name}` : ''}.yml`]: 'ci.yml',
@@ -46,6 +51,12 @@ const sharedRoot = (name) => ({
   },
 })
 
+const sharedRootRm = () => ({
+  '.github/workflows/pull-request.yml': {
+    filter: (p) => p.config.allPrivate,
+  },
+})
+
 // Changes applied to the root of the repo
 const rootRepo = {
   add: {
@@ -55,13 +66,13 @@ const rootRepo = {
     '.github/CODEOWNERS': 'CODEOWNERS',
     '.github/workflows/audit.yml': 'audit.yml',
     '.github/workflows/codeql-analysis.yml': 'codeql-analysis.yml',
-    '.github/workflows/pull-request.yml': 'pull-request.yml',
-    ...sharedRoot(),
+    ...sharedRootAdd(),
+  },
+  rm: {
+    '.github/workflows/release-test.yml': true,
+    '.github/workflows/release-please.yml': true,
+    ...sharedRootRm(),
   },
-  rm: [
-    '.github/workflows/release-test.yml',
-    '.github/workflows/release-please.yml',
-  ],
 }
 
 // These are also applied to the root of the repo
@@ -86,12 +97,13 @@ const rootModule = {
 // Changes for each workspace but applied to the root of the repo
 const workspaceRepo = {
   add: {
-    ...sharedRoot('{{ pkgNameFs }}'),
+    ...sharedRootAdd('{{ pkgNameFs }}'),
   },
-  rm: [
+  rm: {
     // These are the old release please files that should be removed now
-    '.github/workflows/release-please-{{ pkgNameFs }}.yml',
-  ],
+    '.github/workflows/release-please-{{ pkgNameFs }}.yml': true,
+    ...sharedRootRm(),
+  },
 }
 
 // Changes for each workspace but applied to the relative workspace dir
diff --git a/lib/content/release-please-config.json b/lib/content/release-please-config.json
index 3562cee3..dca63a1e 100644
--- a/lib/content/release-please-config.json
+++ b/lib/content/release-please-config.json
@@ -1,6 +1,6 @@
 {
   "separate-pull-requests": {{{ del }}},
-  "plugins": {{#if isMono }}["node-workspace"]{{ else }}{{{ del }}}{{/if}},
+  "plugins": {{#if isMonoPublic }}["node-workspace"]{{ else }}{{{ del }}}{{/if}},
   "exclude-packages-from-root": true,
   "group-pull-request-title-pattern": "chore: release ${version}",
   "pull-request-title-pattern": "chore: release${component} ${version}",
diff --git a/lib/util/files.js b/lib/util/files.js
index 2e190064..53e58c33 100644
--- a/lib/util/files.js
+++ b/lib/util/files.js
@@ -43,7 +43,14 @@ const getParsers = (dir, files, options) => {
 }
 
 const getRemovals = async (dir, files, options) => {
-  const targets = fileEntries(dir, files, options).map(([t]) => globify(t))
+  const targets = fileEntries(dir, files, options)
+    .filter(([, source]) => {
+      if (typeof source === 'object' && typeof source.filter === 'function') {
+        return source.filter(options)
+      }
+      return true
+    })
+    .map(([t]) => globify(t))
   const globs = await Promise.all(targets.map(t => glob(t, { cwd: dir })))
   return globs.flat()
 }
diff --git a/release-please-config.json b/release-please-config.json
index ae769477..e7ea5c84 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -32,8 +32,5 @@
   },
   "exclude-packages-from-root": true,
   "group-pull-request-title-pattern": "chore: release ${version}",
-  "pull-request-title-pattern": "chore: release${component} ${version}",
-  "plugins": [
-    "node-workspace"
-  ]
+  "pull-request-title-pattern": "chore: release${component} ${version}"
 }
diff --git a/tap-snapshots/test/apply/files-snapshots.js.test.cjs b/tap-snapshots/test/apply/files-snapshots.js.test.cjs
index b59a4af3..382a5258 100644
--- a/tap-snapshots/test/apply/files-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/files-snapshots.js.test.cjs
@@ -118,6 +118,7 @@ exports[`test/apply/files-snapshots.js TAP workspaces > expect resolving Promise
 .github/workflows/ci-d.yml
 .github/workflows/ci-release.yml
 .github/workflows/post-dependabot.yml
+.github/workflows/pull-request.yml
 .github/workflows/release.yml
 .release-please-manifest.json
 package.json
@@ -141,6 +142,7 @@ exports[`test/apply/files-snapshots.js TAP workspaces only (like npm/cli) > expe
 .github/workflows/ci-b.yml
 .github/workflows/ci-release.yml
 .github/workflows/post-dependabot.yml
+.github/workflows/pull-request.yml
 .github/workflows/release.yml
 .release-please-manifest.json
 package.json
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index c289f6dc..1582e300 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -3758,6 +3758,57 @@ jobs:
           echo "for more information on how to fix this with a BREAKING CHANGE footer."
           exit 1
 
+.github/workflows/pull-request.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Pull Request
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+jobs:
+  commitlint:
+    name: Lint Commits
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+      - name: Install npm@latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Run Commitlint on Commits
+        id: commit
+        continue-on-error: true
+        run: |
+          npx --offline commitlint -V --from origin/\${{ github.base_ref }} --to \${{ github.event.pull_request.head.sha }}
+      - name: Run Commitlint on PR Title
+        if: steps.commit.outcome == 'failure'
+        run: |
+          echo \${{ github.event.pull_request.title }} | npx --offline commitlint -V
+
 .github/workflows/release.yml
 ========================================
 # This file is automatically added by @npmcli/template-oss. Do not edit.
diff --git a/tap-snapshots/test/check/snapshots.js.test.cjs b/tap-snapshots/test/check/snapshots.js.test.cjs
index e9d4657e..0e317bad 100644
--- a/tap-snapshots/test/check/snapshots.js.test.cjs
+++ b/tap-snapshots/test/check/snapshots.js.test.cjs
@@ -368,6 +368,7 @@ The following repo files need to be added:
   .github/workflows/ci-name-aaaa.yml
   .github/workflows/ci-release.yml
   .github/workflows/post-dependabot.yml
+  .github/workflows/pull-request.yml
   .github/workflows/release.yml
   .release-please-manifest.json
   release-please-config.json
@@ -438,6 +439,7 @@ The following repo files need to be added:
   .github/workflows/ci-bbb.yml
   .github/workflows/ci-release.yml
   .github/workflows/post-dependabot.yml
+  .github/workflows/pull-request.yml
   .github/workflows/release.yml
   .release-please-manifest.json
   release-please-config.json
diff --git a/test/apply/release-config.js b/test/apply/release-config.js
new file mode 100644
index 00000000..ba6ce921
--- /dev/null
+++ b/test/apply/release-config.js
@@ -0,0 +1,36 @@
+const t = require('tap')
+const setup = require('../setup.js')
+
+t.test('no plugin for root only', async (t) => {
+  const s = await setup(t)
+  await s.apply()
+
+  const releaseConfig = await s.readJson('release-please-config.json')
+  t.equal(releaseConfig.plugins, undefined)
+})
+
+t.test('has plugin for workspace', async (t) => {
+  const s = await setup(t, {
+    workspaces: {
+      a: 'a',
+    },
+  })
+  await s.apply()
+
+  const releaseConfig = await s.readJson('release-please-config.json')
+  t.strictSame(releaseConfig.plugins, ['node-workspace'])
+})
+
+t.test('no plugin for private workspace', async (t) => {
+  const s = await setup(t, {
+    workspaces: {
+      a: {
+        private: true,
+      },
+    },
+  })
+  await s.apply()
+
+  const releaseConfig = await s.readJson('release-please-config.json')
+  t.equal(releaseConfig.plugins, undefined)
+})