diff --git a/.github/workflows/publish-npm.yaml b/.github/workflows/publish-npm.yaml
index 468c3b8fe3..d4c0069b0f 100644
--- a/.github/workflows/publish-npm.yaml
+++ b/.github/workflows/publish-npm.yaml
@@ -24,7 +24,10 @@ jobs:
             - uses: ./.github/workflows/setup
             # Trusted Publishing requires npm >= 11.5.1; the pinned Node
             # runtime ships an older npm, so upgrade it before publishing.
-            - run: npm install -g npm@latest
+            # Pinned to major 11: npm@latest moved to 12.0.0, which requires
+            # Node ^22.22.2 || ^24.15.0 || >=26 and EBADENGINEs on our pinned
+            # Node (.nvmrc), breaking every publish.
+            - run: npm install -g npm@11
             # Run via npm so node_modules/.bin is on PATH (patch-npm-version.ts
             # is executed through its ts-node shebang).
             - run: npm run pub:npm