diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1ac8149b..672326981 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
@@ -61,7 +61,7 @@ jobs:
         with:
           node-version: lts/*
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
@@ -88,7 +88,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/devenv-e2e.yml b/.github/workflows/devenv-e2e.yml
index 50ae76bac..b7827b7a6 100644
--- a/.github/workflows/devenv-e2e.yml
+++ b/.github/workflows/devenv-e2e.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           node-version: 'lts/*'
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index de94db533..e3e8ff912 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -21,9 +21,6 @@ jobs:
       pull-requests: write
     steps:
       - uses: Automattic/vip-actions/npm-publish@c8022b66e78461df4f802b935dc0dbb8399f96bc # v0.7.4
-        env:
-          # npm@12 no longer supports npm-shrinkwrap.json with npm ci in this repository.
-          NPM_CONFIG_TAG: next-11
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           USE_TRUSTED_PUBLISHING: 'true'
@@ -60,9 +57,6 @@ jobs:
       pull-requests: write
     steps:
       - uses: Automattic/vip-actions/npm-publish-prerelease@c8022b66e78461df4f802b935dc0dbb8399f96bc # v0.7.4
-        env:
-          # npm@12 no longer supports npm-shrinkwrap.json with npm ci in this repository.
-          NPM_CONFIG_TAG: next-11
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           USE_TRUSTED_PUBLISHING: 'true'
diff --git a/.github/workflows/sea-build-sign.yml b/.github/workflows/sea-build-sign.yml
index 7f0da2b10..e538fd8a5 100644
--- a/.github/workflows/sea-build-sign.yml
+++ b/.github/workflows/sea-build-sign.yml
@@ -60,7 +60,7 @@ jobs:
         with:
           node-version: '22.x'
           cache: npm
-          cache-dependency-path: npm-shrinkwrap.json
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 000000000..51ddce0d3
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+allow-git=root
diff --git a/docs/COMMANDER-MIGRATION.md b/docs/COMMANDER-MIGRATION.md
index 7cb5812b6..becbedc12 100644
--- a/docs/COMMANDER-MIGRATION.md
+++ b/docs/COMMANDER-MIGRATION.md
@@ -5,7 +5,7 @@ Goal: remove the abandoned `args` package, keep CLI behavior stable, and support
 ## Migration Outcome
 
 - `src/lib/cli/command.js` is the active Commander-backed compatibility wrapper for all bins that call `command()`.
-- `args` has been removed from `package.json` and `npm-shrinkwrap.json`.
+- `args` has been removed from `package.json` and `package-lock.json`.
 - Root command flow (`src/bin/vip.js`) now dispatches via the shared Commander wrapper again, preserving login gating and subcommand chaining.
 - Temporary side-path wrapper work has been removed (`src/lib/cli/command-commander.ts` deleted).
 
diff --git a/npm-shrinkwrap.json b/package-lock.json
similarity index 100%
rename from npm-shrinkwrap.json
rename to package-lock.json