diff --git a/.npmrc b/.npmrc
index 9efdcbe6d..9c7382baf 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,5 +1,3 @@
 # npm v11+ settings (not pnpm — pnpm v11 only reads auth/registry from .npmrc).
 ignore-scripts=true
 min-release-age=7
-trust-policy=no-downgrade
-trust-policy-exclude[]=undici@6.21.3
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 2402f1bfd..220432030 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -216,6 +216,15 @@ overrides:
   yaml: 'catalog:'
   yargs-parser: 'catalog:'
 
+# Auto-install missing peer deps (pnpm default). Declared explicitly
+# so a future default flip can't silently change install behavior.
+autoInstallPeers: true
+
+# Run pre/post lifecycle scripts on the workspace root (e.g.
+# prepare -> husky). This is the pnpm default; declared explicitly
+# so a future default flip can't silently disable husky setup.
+enablePrePostScripts: true
+
 # Patched dependencies (migrated from package.json pnpm.patchedDependencies).
 patchedDependencies:
   '@npmcli/run-script@10.0.4': patches/@npmcli__run-script@10.0.4.patch