diff --git a/README.md b/README.md
index 6650427..9f4e03b 100644
--- a/README.md
+++ b/README.md
@@ -76,6 +76,10 @@ updates arrive as one grouped PR each Monday morning and merge themselves (`plat
 off because free private repos have no required checks, so GitHub's own auto-merge would not
 wait for CI); majors open as PRs for a person. `basmith7/workflows@main` refs are never touched.
 
+Renovate regenerates lockfiles with npm 10 (`constraints`), the npm that ships with CI's Node 22.
+Its default npm 12 refuses the registry tarball URLs in Tailwind's lockfile entries (`EALLOWREMOTE`,
+npm/cli#9800); move the pin with CI's Node version.
+
 `@basmith7/*` packages on GitHub Packages are read with the `GH_PACKAGES_TOKEN` credential (a
 classic token with `read:packages`), stored in the Mend developer portal
 (developer.mend.io → basmith7 → Settings → Credentials). The hosted app no longer reads
diff --git a/default.json b/default.json
index e602062..f787e5c 100644
--- a/default.json
+++ b/default.json
@@ -9,6 +9,7 @@
   "platformAutomerge": false,
   "automergeType": "pr",
   "automergeStrategy": "merge-commit",
+  "constraints": { "npm": "^10" },
   "hostRules": [
     {
       "hostType": "npm",