diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
index 32e39859bc..35f5a3c2ee 100644
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -1664,7 +1664,7 @@ jobs:
       - name: Pin npm CLI for publication
         env:
           NPM_CLI_VERSION: "11.12.1"
-        run: npm install --global "npm@${NPM_CLI_VERSION}"
+        run: npm install --global --ignore-scripts "npm@${NPM_CLI_VERSION}"
 
       - name: Compute RC version
         id: version
@@ -1887,7 +1887,7 @@ jobs:
       - name: Pin npm CLI for publication
         env:
           NPM_CLI_VERSION: "11.12.1"
-        run: npm install --global "npm@${NPM_CLI_VERSION}"
+        run: npm install --global --ignore-scripts "npm@${NPM_CLI_VERSION}"
 
       - name: Download tested npm compatibility artifact
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
diff --git a/tests/integration/ci/registry-release-workflow.test.ts b/tests/integration/ci/registry-release-workflow.test.ts
index ce1fda784c..70b0780e51 100644
--- a/tests/integration/ci/registry-release-workflow.test.ts
+++ b/tests/integration/ci/registry-release-workflow.test.ts
@@ -856,7 +856,7 @@ printf '%064d  %s\n' 0 "$1"
       );
       assertEquals(
         npmPinStep.run,
-        'npm install --global "npm@${NPM_CLI_VERSION}"',
+        'npm install --global --ignore-scripts "npm@${NPM_CLI_VERSION}"',
       );
       assert(
         jobSteps.indexOf(npmPinStep) < jobSteps.indexOf(publishStep),