diff --git a/.github/actions/eng-metrics/.npmrc b/.github/actions/eng-metrics/.npmrc
new file mode 100644
index 0000000000..44f74404d4
--- /dev/null
+++ b/.github/actions/eng-metrics/.npmrc
@@ -0,0 +1,2 @@
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
diff --git a/.github/workflows/build-fleetd-base-msi.yml b/.github/workflows/build-fleetd-base-msi.yml
index d71a34416e..9f75f56aa9 100644
--- a/.github/workflows/build-fleetd-base-msi.yml
+++ b/.github/workflows/build-fleetd-base-msi.yml
@@ -36,6 +36,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/build-fleetd-base-pkg.yml b/.github/workflows/build-fleetd-base-pkg.yml
index c2e3bdc61f..cf78957e5a 100644
--- a/.github/workflows/build-fleetd-base-pkg.yml
+++ b/.github/workflows/build-fleetd-base-pkg.yml
@@ -35,6 +35,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     runs-on: macos-latest
diff --git a/.github/workflows/check-automated-doc.yml b/.github/workflows/check-automated-doc.yml
index f8f9dca64a..803c12e592 100644
--- a/.github/workflows/check-automated-doc.yml
+++ b/.github/workflows/check-automated-doc.yml
@@ -27,6 +27,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   check-doc-gen:
     runs-on: macos-latest
diff --git a/.github/workflows/collect-eng-metrics-test.yml b/.github/workflows/collect-eng-metrics-test.yml
index 6584bf57d5..03e1a14b08 100644
--- a/.github/workflows/collect-eng-metrics-test.yml
+++ b/.github/workflows/collect-eng-metrics-test.yml
@@ -21,6 +21,10 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   test:
     name: Test Engineering Metrics Action
diff --git a/.github/workflows/collect-eng-metrics.yml b/.github/workflows/collect-eng-metrics.yml
index b2f610305f..caeaaf1052 100644
--- a/.github/workflows/collect-eng-metrics.yml
+++ b/.github/workflows/collect-eng-metrics.yml
@@ -14,6 +14,10 @@ permissions:
   contents: read          # fetch repo metadata
   pull-requests: read     # read PR timelines
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   collect-metrics:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/deploy-agent-downloader.yml b/.github/workflows/deploy-agent-downloader.yml
index dbb1d2440d..89ac3b4683 100644
--- a/.github/workflows/deploy-agent-downloader.yml
+++ b/.github/workflows/deploy-agent-downloader.yml
@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     permissions:
diff --git a/.github/workflows/deploy-fleet-website.yml b/.github/workflows/deploy-fleet-website.yml
index 842cfde2a2..4f8f62797c 100644
--- a/.github/workflows/deploy-fleet-website.yml
+++ b/.github/workflows/deploy-fleet-website.yml
@@ -24,6 +24,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     if: ${{ github.repository == 'fleetdm/fleet' }}
diff --git a/.github/workflows/deploy-vulnerability-dashboard.yml b/.github/workflows/deploy-vulnerability-dashboard.yml
index eea807613c..c639263321 100644
--- a/.github/workflows/deploy-vulnerability-dashboard.yml
+++ b/.github/workflows/deploy-vulnerability-dashboard.yml
@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     permissions:
diff --git a/.github/workflows/e2e-agent.yml b/.github/workflows/e2e-agent.yml
index b25ff10132..e041242d28 100644
--- a/.github/workflows/e2e-agent.yml
+++ b/.github/workflows/e2e-agent.yml
@@ -45,6 +45,10 @@ defaults:
     # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
     shell: bash
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
 
   # Generate a random UUID to be used for the Cloudflare tunnel subdomain and make it available to later jobs.
diff --git a/.github/workflows/fleetctl-preview.yml b/.github/workflows/fleetctl-preview.yml
index 96d71e872c..8b0d5f78ad 100644
--- a/.github/workflows/fleetctl-preview.yml
+++ b/.github/workflows/fleetctl-preview.yml
@@ -17,6 +17,10 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   test-preview:
     timeout-minutes: 60
diff --git a/.github/workflows/release-fleetd-base.yml b/.github/workflows/release-fleetd-base.yml
index 098b66e084..8ffe247469 100644
--- a/.github/workflows/release-fleetd-base.yml
+++ b/.github/workflows/release-fleetd-base.yml
@@ -38,6 +38,8 @@ env:
   R2_ACCESS_KEY_SECRET: ${{ secrets.R2_DOWNLOAD_ACCESS_KEY_SECRET }} # Production: ${{ secrets.R2_DOWNLOAD_ACCESS_KEY_SECRET }} | Testing: ${{ secrets.R2_DOWNLOAD_TESTING_ACCESS_KEY_SECRET }}
   R2_BUCKET: download # Production: download | Testing: download-testing
   BASE_URL: https://download.fleetdm.com # Production: https://download.fleetdm.com | Testing: https://download-testing.fleetdm.com
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
 
 jobs:
   check-for-fleetd-component-updates:
diff --git a/.github/workflows/release-fleetd-chrome-beta.yml b/.github/workflows/release-fleetd-chrome-beta.yml
index 2fefb64e8c..79c5fd21bb 100644
--- a/.github/workflows/release-fleetd-chrome-beta.yml
+++ b/.github/workflows/release-fleetd-chrome-beta.yml
@@ -26,6 +26,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   release-fleetd-chrome-beta:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release-fleetd-chrome.yml b/.github/workflows/release-fleetd-chrome.yml
index 09251f3d4c..0f275792c3 100644
--- a/.github/workflows/release-fleetd-chrome.yml
+++ b/.github/workflows/release-fleetd-chrome.yml
@@ -27,6 +27,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   release-fleetd-chrome:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-fleet-agent-downloader-changes.yml b/.github/workflows/test-fleet-agent-downloader-changes.yml
index 566de42dfc..1eba3bd9a4 100644
--- a/.github/workflows/test-fleet-agent-downloader-changes.yml
+++ b/.github/workflows/test-fleet-agent-downloader-changes.yml
@@ -12,6 +12,10 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     permissions:
diff --git a/.github/workflows/test-fleetd-chrome.yml b/.github/workflows/test-fleetd-chrome.yml
index 9bc5fb86b4..4d49a4f7c2 100644
--- a/.github/workflows/test-fleetd-chrome.yml
+++ b/.github/workflows/test-fleetd-chrome.yml
@@ -23,6 +23,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   test-fleetd-chrome:
     strategy:
diff --git a/.github/workflows/test-vulnerability-dashboard-changes.yml b/.github/workflows/test-vulnerability-dashboard-changes.yml
index 262d9bbc0e..6a5ce510c2 100644
--- a/.github/workflows/test-vulnerability-dashboard-changes.yml
+++ b/.github/workflows/test-vulnerability-dashboard-changes.yml
@@ -12,6 +12,10 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     permissions:
diff --git a/.github/workflows/test-website.yml b/.github/workflows/test-website.yml
index 25bf943a30..555f213ede 100644
--- a/.github/workflows/test-website.yml
+++ b/.github/workflows/test-website.yml
@@ -24,6 +24,10 @@ defaults:
 permissions:
   contents: read
 
+env:
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/update-old-tuf-timestamp-signature.yaml b/.github/workflows/update-old-tuf-timestamp-signature.yaml
index abc1c9370f..5f610fe01d 100644
--- a/.github/workflows/update-old-tuf-timestamp-signature.yaml
+++ b/.github/workflows/update-old-tuf-timestamp-signature.yaml
@@ -14,6 +14,8 @@ defaults:
 env:
   AWS_REGION: us-east-1
   AWS_IAM_ROLE: arn:aws:iam::142412512209:role/github-actions-role
+  # Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
+  NPM_CONFIG_MIN_RELEASE_AGE: 0.5
 
 permissions:
   id-token: write # This is required for aws-actions/configure-aws-credentials
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000000..0b8f194541
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,8 @@
+# Refuse to install package versions younger than 12 hours (0.5 days). Guards
+# against supply-chain attacks where malicious versions get yanked within hours
+# of publication.
+#
+# Honored by npm (>=11.5) and npx. NOT honored by Yarn 1 — yarn.lock-managed
+# projects (root, tools/fleetctl-npm, tools/fleet-slackbot, ee/tools/license)
+# rely on their pinned lockfile entries instead.
+min-release-age=0.5
diff --git a/ee/fleet-agent-downloader/.npmrc b/ee/fleet-agent-downloader/.npmrc
index 43601ce8db..a8675f0f87 100644
--- a/ee/fleet-agent-downloader/.npmrc
+++ b/ee/fleet-agent-downloader/.npmrc
@@ -9,3 +9,6 @@ loglevel=error
 
 # Make "npm audit" an opt-in thing for subsequent installs within this app:
 audit=false
+
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
diff --git a/ee/fleetd-chrome/.npmrc b/ee/fleetd-chrome/.npmrc
new file mode 100644
index 0000000000..44f74404d4
--- /dev/null
+++ b/ee/fleetd-chrome/.npmrc
@@ -0,0 +1,2 @@
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
diff --git a/ee/vulnerability-dashboard/.npmrc b/ee/vulnerability-dashboard/.npmrc
index 43601ce8db..a8675f0f87 100644
--- a/ee/vulnerability-dashboard/.npmrc
+++ b/ee/vulnerability-dashboard/.npmrc
@@ -9,3 +9,6 @@ loglevel=error
 
 # Make "npm audit" an opt-in thing for subsequent installs within this app:
 audit=false
+
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5
diff --git a/website/.npmrc b/website/.npmrc
index 43601ce8db..a8675f0f87 100644
--- a/website/.npmrc
+++ b/website/.npmrc
@@ -9,3 +9,6 @@ loglevel=error
 
 # Make "npm audit" an opt-in thing for subsequent installs within this app:
 audit=false
+
+# Refuse to install package versions younger than 12 hours (0.5 days). Supply-chain guard.
+min-release-age=0.5