diff --git a/.github/actions/setup-npm/action.yml b/.github/actions/setup-npm/action.yml
new file mode 100644
index 0000000000000..35ae231dcaf18
--- /dev/null
+++ b/.github/actions/setup-npm/action.yml
@@ -0,0 +1,54 @@
+name: 'Set up npm'
+description: 'Installs the npm version required by the devEngines field of package.json, so every job resolves dependencies identically. Keeps the bundled npm when the field is absent.'
+
+inputs:
+  working-directory:
+    description: 'Optional. The directory holding the package.json to read the required npm version from. Defaults to the workspace root.'
+    required: false
+    default: '.'
+  cache:
+    description: 'Optional. Whether to restore and save the npm cache. Defaults to true.'
+    required: false
+    default: 'true'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install npm
+      id: npm
+      env:
+        WORKING_DIRECTORY: ${{ inputs.working-directory }}
+      run: |
+        NPM_VERSION="$(jq -r '.devEngines.packageManager.version // empty' package.json)"
+        if [ -n "$NPM_VERSION" ]; then
+          # Contributors need the floor; CI stays on that major's newest release.
+          npm install --global "npm@${NPM_VERSION/>=/^}"
+          echo "Required npm version: $NPM_VERSION"
+        else
+          echo "No devEngines.packageManager.version, keeping the bundled npm."
+        fi
+        echo "Installed npm version: $(npm --version)"
+
+        # actions/setup-node cannot restore the npm cache: it locates the
+        # directory with `npm config get cache`, which runs before this step
+        # and fails the devEngines check under the bundled npm.
+        echo "cache-dir=$(npm config get cache | tr -d '\r')" >> "$GITHUB_OUTPUT"
+
+        # Keep the hashFiles patterns workspace-relative and free of a "./"
+        # prefix, so they match the same files as every other cache key.
+        PATH_PREFIX=""
+        if [ "$WORKING_DIRECTORY" != '.' ] && [ -n "$WORKING_DIRECTORY" ]; then
+          PATH_PREFIX="${WORKING_DIRECTORY%/}/"
+        fi
+        echo "path-prefix=$PATH_PREFIX" >> "$GITHUB_OUTPUT"
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+
+    - name: Cache npm downloads
+      if: ${{ inputs.cache == 'true' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.npm.outputs.cache-dir }}
+        key: npm-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles(format('{0}package-lock.json', steps.npm.outputs.path-prefix), format('{0}patches/**', steps.npm.outputs.path-prefix)) }}
+        restore-keys: |
+          npm-cache-${{ runner.os }}-${{ runner.arch }}-
diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index e1526d54913f3..ad099ad58460a 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -68,6 +68,7 @@ on:
       - 'composer.*'
       - '**.jshintrc'
       - 'phpcs.xml.dist'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/coding-standards.yml'
       - '.github/workflows/reusable-coding-standards-*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/end-to-end-tests.yml b/.github/workflows/end-to-end-tests.yml
index ca7fb3fae4066..e249f6e25475c 100644
--- a/.github/workflows/end-to-end-tests.yml
+++ b/.github/workflows/end-to-end-tests.yml
@@ -43,6 +43,7 @@ on:
       - 'tools/local-env/**'
       - 'tools/vendors/**'
       - 'tools/webpack/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/end-to-end-tests.yml'
       - '.github/workflows/reusable-end-to-end-tests*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/javascript-tests.yml b/.github/workflows/javascript-tests.yml
index 7734f8fd8e98c..97c6f1099a43e 100644
--- a/.github/workflows/javascript-tests.yml
+++ b/.github/workflows/javascript-tests.yml
@@ -69,6 +69,7 @@ on:
       - 'tools/webpack/**'
       - '.jshintrc'
       - 'tests/qunit/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/javascript-tests.yml'
       - '.github/workflows/reusable-javascript-tests.yml'
   workflow_dispatch:
diff --git a/.github/workflows/javascript-type-checking.yml b/.github/workflows/javascript-type-checking.yml
index 65561cabbb1e1..0bf9288b06e82 100644
--- a/.github/workflows/javascript-type-checking.yml
+++ b/.github/workflows/javascript-type-checking.yml
@@ -24,6 +24,7 @@ on:
       # This directory contains TypeScript definitions. Changes could affect the outcome.
       - 'typings/**'
       # Confirm any changes to relevant workflow files.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/javascript-type-checking.yml'
       - '.github/workflows/reusable-javascript-type-checking-v1.yml'
   workflow_dispatch:
diff --git a/.github/workflows/local-docker-environment.yml b/.github/workflows/local-docker-environment.yml
index 894aeeebd779c..c636c695b6d44 100644
--- a/.github/workflows/local-docker-environment.yml
+++ b/.github/workflows/local-docker-environment.yml
@@ -28,6 +28,7 @@ on:
       # These files define the versions to test.
       - '.version-support-*.json'
       # Changes to this and related workflow files should always be verified.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/local-docker-environment.yml'
       - '.github/workflows/reusable-support-json-reader-v1.yml'
       - '.github/workflows/reusable-test-docker-environment-v1.yml'
@@ -55,6 +56,7 @@ on:
       # These files define the versions to test.
       - '.version-support-*.json'
       # Changes to this and related workflow files should always be verified.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/local-docker-environment.yml'
       - '.github/workflows/reusable-support-json-reader-v1.yml'
       - '.github/workflows/reusable-test-docker-environment-v1.yml'
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index c4a3528a552f7..808f299208bc6 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -43,6 +43,7 @@ on:
       - 'tools/local-env/**'
       - 'tools/vendors/**'
       - 'tools/webpack/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/performance.yml'
       - '.github/workflows/reusable-performance-*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/phpstan-static-analysis.yml b/.github/workflows/phpstan-static-analysis.yml
index 6a26c75b16525..edb7a36c10ffa 100644
--- a/.github/workflows/phpstan-static-analysis.yml
+++ b/.github/workflows/phpstan-static-analysis.yml
@@ -20,6 +20,7 @@ on:
       - 'tests/phpstan/base.neon'
       - 'tests/phpstan/baselines/**'
       # Confirm any changes to relevant workflow files.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/phpstan-static-analysis.yml'
       - '.github/workflows/reusable-phpstan-static-analysis-v1.yml'
   workflow_dispatch:
diff --git a/.github/workflows/phpunit-tests-full-matrix.yml b/.github/workflows/phpunit-tests-full-matrix.yml
index a6b42f6401174..eedbbdb087e4e 100644
--- a/.github/workflows/phpunit-tests-full-matrix.yml
+++ b/.github/workflows/phpunit-tests-full-matrix.yml
@@ -42,6 +42,7 @@ on:
       - 'tools/vendors/**'
       - 'tools/webpack/**'
       - 'phpunit.xml.dist'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/phpunit-tests.yml'
       - '.github/workflows/phpunit-tests-full-matrix.yml'
       - '.github/workflows/reusable-phpunit-tests-*.yml'
diff --git a/.github/workflows/phpunit-tests.yml b/.github/workflows/phpunit-tests.yml
index 1e4a22bb61afc..23530363960c4 100644
--- a/.github/workflows/phpunit-tests.yml
+++ b/.github/workflows/phpunit-tests.yml
@@ -46,6 +46,7 @@ on:
       - 'tools/vendors/**'
       - 'tools/webpack/**'
       - 'phpunit.xml.dist'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/phpunit-tests.yml'
       - '.github/workflows/phpunit-tests-full-matrix.yml'
       - '.github/workflows/reusable-phpunit-tests-*.yml'
diff --git a/.github/workflows/reusable-build-package.yml b/.github/workflows/reusable-build-package.yml
index 5005b2149890c..f575cdd10067e 100644
--- a/.github/workflows/reusable-build-package.yml
+++ b/.github/workflows/reusable-build-package.yml
@@ -38,7 +38,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Install npm Dependencies
         run: npm ci
diff --git a/.github/workflows/reusable-coding-standards-javascript.yml b/.github/workflows/reusable-coding-standards-javascript.yml
index 8c0ea06345b85..d55f7ef95f48e 100644
--- a/.github/workflows/reusable-coding-standards-javascript.yml
+++ b/.github/workflows/reusable-coding-standards-javascript.yml
@@ -43,7 +43,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-end-to-end-tests.yml b/.github/workflows/reusable-end-to-end-tests.yml
index 54effadf3d7d4..0c9e772320a1e 100644
--- a/.github/workflows/reusable-end-to-end-tests.yml
+++ b/.github/workflows/reusable-end-to-end-tests.yml
@@ -85,7 +85,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-javascript-tests.yml b/.github/workflows/reusable-javascript-tests.yml
index c0bf656d124bb..661dc1d80dd11 100644
--- a/.github/workflows/reusable-javascript-tests.yml
+++ b/.github/workflows/reusable-javascript-tests.yml
@@ -44,7 +44,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-javascript-type-checking-v1.yml b/.github/workflows/reusable-javascript-type-checking-v1.yml
index 032fa67bf7be8..c148a0512020e 100644
--- a/.github/workflows/reusable-javascript-type-checking-v1.yml
+++ b/.github/workflows/reusable-javascript-type-checking-v1.yml
@@ -42,7 +42,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-performance-report-v2.yml b/.github/workflows/reusable-performance-report-v2.yml
index a2bce3e7c362b..6d6927c32eed0 100644
--- a/.github/workflows/reusable-performance-report-v2.yml
+++ b/.github/workflows/reusable-performance-report-v2.yml
@@ -65,7 +65,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/reusable-performance-test-v2.yml b/.github/workflows/reusable-performance-test-v2.yml
index b92893f52f7f1..6ca40b3a85100 100644
--- a/.github/workflows/reusable-performance-test-v2.yml
+++ b/.github/workflows/reusable-performance-test-v2.yml
@@ -126,7 +126,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Set up PHP
         if: ${{ inputs.subject == 'base' }}
diff --git a/.github/workflows/reusable-phpstan-static-analysis-v1.yml b/.github/workflows/reusable-phpstan-static-analysis-v1.yml
index dba8158c2fc8a..7325d4a25991d 100644
--- a/.github/workflows/reusable-phpstan-static-analysis-v1.yml
+++ b/.github/workflows/reusable-phpstan-static-analysis-v1.yml
@@ -53,7 +53,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
diff --git a/.github/workflows/reusable-phpunit-tests-v3.yml b/.github/workflows/reusable-phpunit-tests-v3.yml
index 6348d2a5cfbbf..40c728cb83619 100644
--- a/.github/workflows/reusable-phpunit-tests-v3.yml
+++ b/.github/workflows/reusable-phpunit-tests-v3.yml
@@ -219,7 +219,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       ##
       # This allows Composer dependencies to be installed using a single step.
diff --git a/.github/workflows/reusable-prepare-gutenberg.yml b/.github/workflows/reusable-prepare-gutenberg.yml
index 2d2c407ecdc7a..fd7381550f349 100644
--- a/.github/workflows/reusable-prepare-gutenberg.yml
+++ b/.github/workflows/reusable-prepare-gutenberg.yml
@@ -74,6 +74,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
+          package-manager-cache: false
 
       - name: Download and verify Gutenberg build
         id: download
diff --git a/.github/workflows/reusable-test-core-build-process.yml b/.github/workflows/reusable-test-core-build-process.yml
index 1a41257418dec..d333afaccbb39 100644
--- a/.github/workflows/reusable-test-core-build-process.yml
+++ b/.github/workflows/reusable-test-core-build-process.yml
@@ -94,7 +94,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-test-local-docker-environment-v1.yml b/.github/workflows/reusable-test-local-docker-environment-v1.yml
index 71c8a9a739f66..338ca2e9af54b 100644
--- a/.github/workflows/reusable-test-local-docker-environment-v1.yml
+++ b/.github/workflows/reusable-test-local-docker-environment-v1.yml
@@ -95,7 +95,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       ##
       # This allows Composer dependencies to be installed using a single step.
diff --git a/.github/workflows/test-and-zip-default-themes.yml b/.github/workflows/test-and-zip-default-themes.yml
index fc631c5852fef..5d1ccb2ca5e54 100644
--- a/.github/workflows/test-and-zip-default-themes.yml
+++ b/.github/workflows/test-and-zip-default-themes.yml
@@ -10,6 +10,7 @@ on:
       # Changing the preferred version of Node.js could affect themes with build processes.
       - '.npmrc'
       - '.nvmrc'
+      - '.github/actions/setup-npm/**'
       # Changes to any themes with a build script should be confirmed.
       - 'src/wp-content/themes/twentynineteen/**'
       - 'src/wp-content/themes/twentytwenty/**'
@@ -27,6 +28,7 @@ on:
       # Changing the preferred version of Node.js could affect themes with build processes.
       - '.npmrc'
       - '.nvmrc'
+      - '.github/actions/setup-npm/**'
       # Changes to any themes with a build script should be confirmed.
       - 'src/wp-content/themes/twentynineteen/**'
       - 'src/wp-content/themes/twentytwenty/**'
@@ -161,8 +163,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: 'src/wp-content/themes/${{ matrix.theme }}/.nvmrc'
-          cache: npm
-          cache-dependency-path: src/wp-content/themes/${{ matrix.theme }}/package-lock.json
+          package-manager-cache: false
+
+      - name: Set up npm
+        uses: ./.github/actions/setup-npm
+        with:
+          working-directory: src/wp-content/themes/${{ matrix.theme }}
 
       - name: Install npm dependencies
         run: npm ci
@@ -246,8 +252,13 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: 'src/wp-content/themes/${{ matrix.theme }}/.nvmrc'
-          cache: npm
-          cache-dependency-path: src/wp-content/themes/${{ matrix.theme }}/package-lock.json
+          package-manager-cache: false
+
+      - name: Set up npm
+        if: matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive'
+        uses: ./.github/actions/setup-npm
+        with:
+          working-directory: src/wp-content/themes/${{ matrix.theme }}
 
       - name: Install npm dependencies
         if: matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive'
diff --git a/.github/workflows/test-build-processes.yml b/.github/workflows/test-build-processes.yml
index 003fd80d08e08..ed970276e9833 100644
--- a/.github/workflows/test-build-processes.yml
+++ b/.github/workflows/test-build-processes.yml
@@ -43,6 +43,7 @@ on:
       - 'tools/gutenberg/**'
       - 'tools/vendors/**'
       - 'tools/webpack/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/test-build-processes.yml'
       - '.github/workflows/reusable-test-core-build-process.yml'
   workflow_dispatch:
diff --git a/.github/workflows/test-coverage.yml b/.github/workflows/test-coverage.yml
index 191445ba7167c..c29be2fb4043e 100644
--- a/.github/workflows/test-coverage.yml
+++ b/.github/workflows/test-coverage.yml
@@ -6,6 +6,7 @@ on:
     branches:
       - trunk
     paths:
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/test-coverage.yml'
       - '.github/workflows/reusable-phpunit-tests-v3.yml'
       - '.github/workflows/reusable-prepare-gutenberg.yml'
@@ -19,6 +20,7 @@ on:
     branches:
       - trunk
     paths:
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/test-coverage.yml'
       - '.github/workflows/reusable-phpunit-tests-v3.yml'
       - '.github/workflows/reusable-prepare-gutenberg.yml'
diff --git a/.npmrc b/.npmrc
index 01593aba1c0ef..fd8fd9e81ddfa 100644
--- a/.npmrc
+++ b/.npmrc
@@ -3,3 +3,7 @@ legacy-peer-deps = true
 lockfile-version = 3
 prefer-dedupe = true
 save-exact = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/package-lock.json b/package-lock.json
index fd069ad47879c..1ff0dac3b5919 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -96,7 +96,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.0.2"
 			}
 		},
 		"node_modules/@asamuzakjp/css-color": {
diff --git a/package.json b/package.json
index ca760568737a3..efb48ecbe5319 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,18 @@
 	},
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.0.2"
+	},
+	"devEngines": {
+		"runtime": {
+			"name": "node",
+			"version": ">=24.18.0"
+		},
+		"packageManager": {
+			"name": "npm",
+			"version": ">=12.0.2",
+			"onFail": "error"
+		}
 	},
 	"author": "The WordPress Contributors",
 	"license": "GPL-2.0-or-later",
@@ -147,5 +158,15 @@
 		"gutenberg:copy": "node tools/gutenberg/copy.js",
 		"gutenberg:verify": "node tools/gutenberg/utils.js",
 		"gutenberg:download": "node tools/gutenberg/download.js && grunt build:gutenberg"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false,
+		"gifsicle@4.0.1": true,
+		"jpegtran-bin@4.0.0": true,
+		"optipng-bin@5.1.0": true,
+		"unrs-resolver": false
 	}
 }
diff --git a/src/wp-content/themes/twentytwentyfive/.npmrc b/src/wp-content/themes/twentytwentyfive/.npmrc
new file mode 100644
index 0000000000000..ab08bbe0fad23
--- /dev/null
+++ b/src/wp-content/themes/twentytwentyfive/.npmrc
@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/src/wp-content/themes/twentytwentyfive/package-lock.json b/src/wp-content/themes/twentytwentyfive/package-lock.json
index 26fc86bf03862..5844236c398ac 100644
--- a/src/wp-content/themes/twentytwentyfive/package-lock.json
+++ b/src/wp-content/themes/twentytwentyfive/package-lock.json
@@ -16,7 +16,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.0.2"
 			}
 		},
 		"node_modules/@wordpress/browserslist-config": {
diff --git a/src/wp-content/themes/twentytwentyfive/package.json b/src/wp-content/themes/twentytwentyfive/package.json
index 04dab98c23949..1094c2693830b 100644
--- a/src/wp-content/themes/twentytwentyfive/package.json
+++ b/src/wp-content/themes/twentytwentyfive/package.json
@@ -14,7 +14,18 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyfive/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.0.2"
+	},
+	"devEngines": {
+		"runtime": {
+			"name": "node",
+			"version": ">=24.18.0"
+		},
+		"packageManager": {
+			"name": "npm",
+			"version": ">=12.0.2",
+			"onFail": "error"
+		}
 	},
 	"devDependencies": {
 		"@wordpress/browserslist-config": "^6.34.0",
@@ -28,5 +39,8 @@
 	"scripts": {
 		"build": "postcss style.css --use cssnano -o style.min.css --no-map",
 		"watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
+	},
+	"allowScripts": {
+		"fsevents": false
 	}
 }
diff --git a/src/wp-content/themes/twentytwentyone/.npmrc b/src/wp-content/themes/twentytwentyone/.npmrc
index 80bcbed90c4f2..e3265165846bb 100644
--- a/src/wp-content/themes/twentytwentyone/.npmrc
+++ b/src/wp-content/themes/twentytwentyone/.npmrc
@@ -1 +1,5 @@
 legacy-peer-deps = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/src/wp-content/themes/twentytwentyone/package-lock.json b/src/wp-content/themes/twentytwentyone/package-lock.json
index 947acba18edcc..1648ac2ea4d3f 100644
--- a/src/wp-content/themes/twentytwentyone/package-lock.json
+++ b/src/wp-content/themes/twentytwentyone/package-lock.json
@@ -34,7 +34,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.0.2"
 			}
 		},
 		"node_modules/@aashutoshrathi/word-wrap": {
diff --git a/src/wp-content/themes/twentytwentyone/package.json b/src/wp-content/themes/twentytwentyone/package.json
index 7097e3f65f70f..73fb00f360ac1 100644
--- a/src/wp-content/themes/twentytwentyone/package.json
+++ b/src/wp-content/themes/twentytwentyone/package.json
@@ -14,7 +14,18 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyone/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.0.2"
+	},
+	"devEngines": {
+		"runtime": {
+			"name": "node",
+			"version": ">=24.18.0"
+		},
+		"packageManager": {
+			"name": "npm",
+			"version": ">=12.0.2",
+			"onFail": "error"
+		}
 	},
 	"devDependencies": {
 		"@wordpress/browserslist-config": "^6.34.0",
@@ -69,5 +80,11 @@
 		"watch": "chokidar \"**/*.scss\" -c \"npm run build\" --initial",
 		"lint:scss": "stylelint **/*.scss",
 		"lint-fix:scss": "stylelint **/*.scss --fix"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false
 	}
 }
diff --git a/src/wp-content/themes/twentytwentytwo/.npmrc b/src/wp-content/themes/twentytwentytwo/.npmrc
new file mode 100644
index 0000000000000..ab08bbe0fad23
--- /dev/null
+++ b/src/wp-content/themes/twentytwentytwo/.npmrc
@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/src/wp-content/themes/twentytwentytwo/package-lock.json b/src/wp-content/themes/twentytwentytwo/package-lock.json
index ffde012248aad..4cd88e7dbc8c2 100644
--- a/src/wp-content/themes/twentytwentytwo/package-lock.json
+++ b/src/wp-content/themes/twentytwentytwo/package-lock.json
@@ -16,7 +16,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.0.2"
 			}
 		},
 		"node_modules/@wordpress/browserslist-config": {
diff --git a/src/wp-content/themes/twentytwentytwo/package.json b/src/wp-content/themes/twentytwentytwo/package.json
index b0b1a5e15f736..79596a4610417 100644
--- a/src/wp-content/themes/twentytwentytwo/package.json
+++ b/src/wp-content/themes/twentytwentytwo/package.json
@@ -14,7 +14,18 @@
 	"homepage": "https://wordpress.org/themes/twentytwentytwo/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.0.2"
+	},
+	"devEngines": {
+		"runtime": {
+			"name": "node",
+			"version": ">=24.18.0"
+		},
+		"packageManager": {
+			"name": "npm",
+			"version": ">=12.0.2",
+			"onFail": "error"
+		}
 	},
 	"devDependencies": {
 		"@wordpress/browserslist-config": "^6.34.0",
@@ -28,5 +39,8 @@
   "scripts": {
     "build": "postcss style.css --use cssnano -o style.min.css --no-map",
     "watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
-  }
+  },
+	"allowScripts": {
+		"fsevents": false
+	}
 }