diff --git a/.npmrc b/.npmrc
index 2e218c567..7e5439483 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,3 @@
-minReleaseAge=7d
+# Safety net — pnpm-workspace.yaml has the authoritative minimumReleaseAge (4320 min = 3 days)
+# This .npmrc value is a fallback if npm is ever invoked directly
+minReleaseAge=3d
diff --git a/package.json b/package.json
index 33d624746..da99640be 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,7 @@
   "version": "1.2.52",
   "description": "Personal Claude assistant. Lightweight, secure, customizable.",
   "type": "module",
+  "packageManager": "pnpm@10.33.0",
   "main": "dist/index.js",
   "scripts": {
     "build": "tsc",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 000000000..53327583a
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+onlyBuiltDependencies:
+  - better-sqlite3
+  - esbuild
+  - protobufjs
+  - sharp
+
+pnpm:
+  minimumReleaseAge: 4320