diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e034fbb..58ea8e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,11 +25,6 @@ jobs:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Update npm
-        run: |
-          npm -v
-          npm install -g npm@latest
-
       - name: Extract version from tag
         id: tag_version
         run: |
@@ -39,8 +34,10 @@ jobs:
           echo "tag=$TAG_NAME" >> $GITHUB_OUTPUT
           echo "Extracted version: $VERSION from tag: $TAG_NAME"
 
+      # Lint CI uses setup-node's npm as-is. Do not bump to npm@latest here:
+      # npm v12 defaults allow-git=none and breaks github:apple-sign-in.
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --allow-git=all
 
       - name: Extract library projects
         id: libraries
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..4835404
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+; npm v12+ defaults allow-git=none; this repo uses a github: peer for Apple Sign-In.
+allow-git=all