diff --git a/.npmrc b/.npmrc
new file mode 100644
index 000000000..1a99418bf
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+strict-dep-builds=false
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e035e34e3..c906e975a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,3 +11,7 @@ onlyBuiltDependencies:
 # encountered as transitive deps (e.g. scarf pulled in via swagger-ui-dist).
 ignoredBuiltDependencies:
   - '@scarf/scarf'
+# Belt-and-suspenders: even if a fresh transitive dep slips through with a
+# postinstall script, downgrade to a warning so CI doesn't break for
+# downstream plugin repos that pull etherpad-lite as their core install.
+strictDepBuilds: false