diff --git a/.npmrc b/.npmrc
index 827dcde2398..2c652d8914c 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,3 +1,6 @@
+# needed to prevent bad npm that has min-release-age but not exclude
+engine-strict=true
+
 min-release-age=14
 # allow assistant-ui packages & a couple specific deps since they update a LOT.
 # remove this when we stabilize (or we haven't updated in 2 wks)
diff --git a/package.json b/package.json
index d6f12502ffb..d6d6bd62599 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,8 @@
     "brace-expansion": "5.0.8"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.0.0",
+    "npm": "<11.10.0 || >=12.0.0"
   },
   "allowScripts": {
     "unicode-animations": false,
diff --git a/website/.npmrc b/website/.npmrc
index 59829288b4a..016ec44347f 100644
--- a/website/.npmrc
+++ b/website/.npmrc
@@ -1,3 +1,6 @@
+# needed to prevent bad npm that has min-release-age but not exclude
+engine-strict=true
+
 min-release-age=14
 
 # fast-uri 3.1.4 includes fixes for vulns. remove this when 3.1.4 is > 2wks  old
diff --git a/website/package.json b/website/package.json
index 9522bdfbd58..bb752328ad8 100644
--- a/website/package.json
+++ b/website/package.json
@@ -53,7 +53,8 @@
     ]
   },
   "engines": {
-    "node": ">=20.0"
+    "node": ">=20.0",
+    "npm": "<11.10.0 || >=12.0.0"
   },
   "allowScripts": {
     "core-js@3.49.0": true,