diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c29c649..a645b66 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,13 +18,13 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
+      - run: npm ci
+      - run: npm audit --audit-level=high
       - run: npm run lint
       - run: npm run typecheck
       - run: npm run coverage
       - run: npm run build
       - run: npm run demo
-      - run: npm audit --audit-level=high
 
 # Least-privilege: read-only test/CI runs. GITHUB_TOKEN gets no write to
 # anything. The publish/release flows (where they exist) carry their own
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c06ccde..ff4e24a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -27,8 +27,9 @@ jobs:
       # Node 22's bundled npm predates full OIDC trusted-publishing support
       # (needs npm >= 11.5.1); the initial rollout of this workflow 404'd on
       # the actual publish PUT even though provenance signing succeeded.
-      - run: npm install -g npm@latest
-      - run: npm install
+      - run: npm install -g npm@11.5.1 --ignore-scripts
+      - run: npm ci
+      - run: npm audit --audit-level=high
       - run: npm run lint
       - run: npm run typecheck
       - run: npm run coverage