diff --git a/strix/viewer/frontend/.npmrc b/strix/viewer/frontend/.npmrc
new file mode 100644
index 000000000..69ef87aa0
--- /dev/null
+++ b/strix/viewer/frontend/.npmrc
@@ -0,0 +1,6 @@
+# Release-age cooldown: don't resolve a version until it's 6 days old, a guard
+# against a freshly-compromised upstream. Gates npm install/update, not npm ci.
+# Needs npm >= 11.10.0; engine-strict fails an older npm loudly rather than
+# silently skipping the unrecognised key.
+min-release-age=6
+engine-strict=true
diff --git a/strix/viewer/frontend/package.json b/strix/viewer/frontend/package.json
index e79db76fd..a42f65c79 100644
--- a/strix/viewer/frontend/package.json
+++ b/strix/viewer/frontend/package.json
@@ -3,6 +3,9 @@
   "private": true,
   "version": "0.0.0",
   "type": "module",
+  "engines": {
+    "npm": ">=11.10.0"
+  },
   "scripts": {
     "dev": "vite",
     "build": "vite build",