diff --git a/.github/actions/prebuild/action.yml b/.github/actions/prebuild/action.yml
index 75c808d..49b6f1b 100644
--- a/.github/actions/prebuild/action.yml
+++ b/.github/actions/prebuild/action.yml
@@ -144,7 +144,12 @@ runs:
     - name: Install deps for package
       shell: bash
       working-directory: ./package
-      run: npm install
+      # `--ignore-scripts`: the target module is untrusted third-party
+      # code. bare-make drives the native build from CMakeLists afterwards,
+      # so no install-time lifecycle script is needed (same as the
+      # better-sqlite3 workflow). Defence-in-depth alongside the caller
+      # checkout's `persist-credentials: false`.
+      run: npm install --ignore-scripts
 
     - name: Install patched cmake-napi
       shell: bash
diff --git a/.github/workflows/prebuild-all.yml b/.github/workflows/prebuild-all.yml
index ccda34d..f15c2fb 100644
--- a/.github/workflows/prebuild-all.yml
+++ b/.github/workflows/prebuild-all.yml
@@ -140,8 +140,12 @@ jobs:
     name: ${{ inputs.module_name }} (${{ matrix.platform }}-${{ matrix.arch }}${{ matrix.simulator && '-simulator' || '' }})
     steps:
       # Caller's repo — needed so `patches_dir` (a caller-relative path)
-      # resolves against the workspace root.
+      # resolves against the workspace root. `persist-credentials: false`
+      # keeps the caller's GITHUB_TOKEN off disk — see the comment in
+      # prebuild.yml.
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       # Same-ref harness checkout — see the comment in prebuild.yml.
       - name: Checkout prebuild harness
diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index f57bcf3..1fa71be 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -93,8 +93,13 @@ jobs:
       module_version: ${{ steps.prebuild.outputs.module_version }}
     steps:
       # Caller's repo — needed so `patches_dir` (a caller-relative path)
-      # resolves against the workspace root.
+      # resolves against the workspace root. `persist-credentials: false`
+      # keeps the caller's GITHUB_TOKEN out of $GITHUB_WORKSPACE/.git/config
+      # so the untrusted `npm install` of the target module (with lifecycle
+      # scripts) below can't read a (release-write-capable) token off disk.
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       # Check out this repo at the SAME ref this reusable workflow is
       # running from (`job.workflow_sha` resolves the caller's @v2/@main/