diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e78cd8a465..b9726f4d7a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           node-version: 18
           cache: 'npm'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - name: Lint
         run: |
           npm run lint
diff --git a/.github/workflows/peer-api.yaml b/.github/workflows/peer-api.yaml
index e990808746..41648a307a 100644
--- a/.github/workflows/peer-api.yaml
+++ b/.github/workflows/peer-api.yaml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install script dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Check API dependency semantics
         run: node ./scripts/peer-api-check.js
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index d6a72703f6..c67a171863 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -27,7 +27,7 @@ jobs:
 
       - name: Install packages
         run: |
-          npm ci
+          npm ci --ignore-scripts
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
         id: otelbot-token
@@ -80,7 +80,7 @@ jobs:
           # Require npm 11.5.1 or later for https://docs.npmjs.com/trusted-publishers.
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npm run compile
       # Release Please has already incremented versions and published tags, so we just
       # need to publish all unpublished versions to npm here
diff --git a/.github/workflows/test-all-versions.yml b/.github/workflows/test-all-versions.yml
index 70b0b24cf3..259042c0fb 100644
--- a/.github/workflows/test-all-versions.yml
+++ b/.github/workflows/test-all-versions.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           node-version: 18
       - name: Install
-        run: npm ci
+        run: npm ci --ignore-scripts
       - name: Build
         run: npm run compile
       - name: Upload Build Artifacts
@@ -168,7 +168,7 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
       - name: Install
-        run: npm ci
+        run: npm ci --ignore-scripts
       - name: Download Build Artifacts
         uses: actions/download-artifact@v5
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d73441099f..1e9deeeb4c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           node-version: 18
       - name: Install
-        run: npm ci
+        run: npm ci --ignore-scripts
       # Note: when pushing to main we want to test only what changed in
       # last commit. Otherwise we want to test all changes from origin/main.
       # So we set the right values for base and head commits depending
@@ -195,7 +195,7 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
       - name: Install
-        run: npm ci
+        run: npm ci --ignore-scripts
       - name: Download Build Artifacts
         uses: actions/download-artifact@v5
         with:
@@ -244,7 +244,7 @@ jobs:
         with:
           node-version: 18
       - name: Install
-        run: npm ci
+        run: npm ci --ignore-scripts
       # NOTE: keep this in sync with the node versions from `unit-test` job
       - name: Download Test Artifacts (18)
         uses: actions/download-artifact@v5
diff --git a/.github/workflows/update-otel-deps.yaml b/.github/workflows/update-otel-deps.yaml
index 5f8e0acc2a..b910e4722d 100644
--- a/.github/workflows/update-otel-deps.yaml
+++ b/.github/workflows/update-otel-deps.yaml
@@ -29,7 +29,7 @@ jobs:
 
       - run: npm install -g npm@latest
 
-      - run: npm ci
+      - run: npm ci --ignore-scripts
 
       - name: Create/Update Release PR
         run: |