diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index e87d5d2e..beab9bb8 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -35,7 +35,7 @@ jobs:
           corepack prepare yarn@stable --activate
 
       - name: Install dependencies
-        run: yarn
+        run: yarn install --immutable
 
       - name: Install Playwright browsers
         run: |
diff --git a/.yarnrc.yml b/.yarnrc.yml
index 3186f3f0..b85605df 100644
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1 +1,9 @@
 nodeLinker: node-modules
+
+# Supply-chain minimum release age: refuse to install any dependency version
+# published less than 3 days ago (smash-and-grab malware is usually yanked
+# within hours). Internal @convertcom/* packages are exempt so our own release
+# chain never stalls on a freshly-published package.
+npmMinimalAgeGate: 4320
+npmPreapprovedPackages:
+  - "@convertcom/*"