diff --git a/gulpfile.js b/gulpfile.js
index f347a251..8b3941b4 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -81,7 +81,8 @@ function zipper(done) {
             '!dist', '!dist/**',
             '!pnpm-debug.log',
             '!pnpm-lock.yaml',
-            '!pnpm-workspace.yaml',
+            // Keep pnpm-workspace.yaml so standalone installs inherit
+            // the supply-chain policy.
             '!AGENTS.md',
             '!CLAUDE.md',
             '!gulpfile.js'
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 86556e06..4ca9157d 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,7 @@
+strictDepBuilds: true
+minimumReleaseAge: 4320
+blockExoticSubdeps: true
+
 allowBuilds:
   # Optional dtrace bindings for bunyan through gscan; not needed to build, zip, or scan the theme.
   dtrace-provider: false