diff --git a/.npmrc b/.npmrc
new file mode 100644
index 00000000..233ac8e7
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,12 @@
+# Dependency lifecycle scripts (preinstall/install/postinstall) are arbitrary
+# code from 1490 third-party packages, and CI runs `npm ci` in jobs that hold a
+# write-scoped GITHUB_TOKEN (architecture-submission, import-architectures,
+# pr-queue-hygiene, create-milestones). Nothing in this project needs them, so
+# they are not run. Verified: no package.json lifecycle hooks exist, and only
+# three dependencies declare install scripts, none of them load-bearing:
+#   - @swc/core        postinstall is an advisory warning only; the native
+#                      binding ships prebuilt in @swc/core-linux-x64-gnu, which
+#                      declares no install script of its own.
+#   - core-js          postinstall prints a funding banner.
+#   - fsevents         macOS-only and optional; chokidar falls back without it.
+ignore-scripts=true
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 809e32d2..ebc7babe 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -16,6 +16,12 @@ npm run docus:start
 matching CI. Reach for `npm install <package>` only to add or upgrade a
 dependency, and commit the resulting lockfile change deliberately.
 
+The repository's `.npmrc` sets `ignore-scripts=true`, so neither command runs
+dependency lifecycle scripts. That is deliberate: CI installs this tree in jobs
+that hold a write-scoped `GITHUB_TOKEN`, and no dependency here needs an install
+script to work. If a future dependency genuinely does, say so in the pull
+request rather than dropping the setting.
+
 The dev server runs at `http://localhost:3000`. In the devcontainer:
 
 ```bash