diff --git a/.npmrc b/.npmrc
index d67f3748..7147343e 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,5 @@
 node-linker=hoisted
+
+# Supply chain protection: only resolve package versions published at least 7 days ago.
+min-release-age=7
+min-release-age-exclude[]=eslint-config-expensify