diff --git a/.npmrc b/.npmrc
index 01593aba1c0ef..1266a1ee20ab8 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,5 +1,8 @@
 engine-strict = true
 legacy-peer-deps = true
-lockfile-version = 3
 prefer-dedupe = true
 save-exact = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/README.md b/README.md
index cb64a35538457..fdd451ba8ba9b 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ You will need Node and npm installed on your computer. Node is a JavaScript runt
 
 If you are not using a package manager, see the [Node.js download page](https://nodejs.org/en/download/) for installers and binaries.
 
-**Note:** WordPress currently only officially supports Node.js `24.x` and npm `11.x`.
+**Note:** WordPress currently only officially supports Node.js `24.x` and npm `12.x`. If your Node.js installation comes with an older npm, install the required version with `npm install --global npm@12`.
 
 You will also need a container environment such as [Docker Desktop](https://www.docker.com/products/docker-desktop) installed and running on your computer. The container environment is the virtualization software that powers the local development environment and can be installed just like any other regular application.
 
diff --git a/package-lock.json b/package-lock.json
index 870b053253af4..a3287bea6c023 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -98,7 +98,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.2.0"
 			}
 		},
 		"node_modules/@343dev/gifsicle": {
diff --git a/package.json b/package.json
index 8f3be7558b3d2..ea6687bdd7712 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
 	},
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -21,7 +21,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -160,5 +160,12 @@
 		"gutenberg:copy": "node tools/gutenberg/copy.js",
 		"gutenberg:verify": "node tools/gutenberg/utils.js",
 		"gutenberg:download": "node tools/gutenberg/download.js && npm run build:gutenberg"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false,
+		"unrs-resolver": false
 	}
 }
diff --git a/src/wp-content/themes/twentytwentyfive/.npmrc b/src/wp-content/themes/twentytwentyfive/.npmrc
new file mode 100644
index 0000000000000..ab08bbe0fad23
--- /dev/null
+++ b/src/wp-content/themes/twentytwentyfive/.npmrc
@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/src/wp-content/themes/twentytwentyfive/package-lock.json b/src/wp-content/themes/twentytwentyfive/package-lock.json
index 26fc86bf03862..26c636e82e639 100644
--- a/src/wp-content/themes/twentytwentyfive/package-lock.json
+++ b/src/wp-content/themes/twentytwentyfive/package-lock.json
@@ -16,7 +16,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.2.0"
 			}
 		},
 		"node_modules/@wordpress/browserslist-config": {
diff --git a/src/wp-content/themes/twentytwentyfive/package.json b/src/wp-content/themes/twentytwentyfive/package.json
index f1b983e045db3..557ec1f3a1414 100644
--- a/src/wp-content/themes/twentytwentyfive/package.json
+++ b/src/wp-content/themes/twentytwentyfive/package.json
@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyfive/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -39,5 +39,8 @@
 	"scripts": {
 		"build": "postcss style.css --use cssnano -o style.min.css --no-map",
 		"watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
+	},
+	"allowScripts": {
+		"fsevents": false
 	}
 }
diff --git a/src/wp-content/themes/twentytwentyone/.npmrc b/src/wp-content/themes/twentytwentyone/.npmrc
index 80bcbed90c4f2..e3265165846bb 100644
--- a/src/wp-content/themes/twentytwentyone/.npmrc
+++ b/src/wp-content/themes/twentytwentyone/.npmrc
@@ -1 +1,5 @@
 legacy-peer-deps = true
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/src/wp-content/themes/twentytwentyone/package-lock.json b/src/wp-content/themes/twentytwentyone/package-lock.json
index 947acba18edcc..859d7f11133e5 100644
--- a/src/wp-content/themes/twentytwentyone/package-lock.json
+++ b/src/wp-content/themes/twentytwentyone/package-lock.json
@@ -34,7 +34,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.2.0"
 			}
 		},
 		"node_modules/@aashutoshrathi/word-wrap": {
diff --git a/src/wp-content/themes/twentytwentyone/package.json b/src/wp-content/themes/twentytwentyone/package.json
index 603b5bdf36e43..80db402500d86 100644
--- a/src/wp-content/themes/twentytwentyone/package.json
+++ b/src/wp-content/themes/twentytwentyone/package.json
@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentyone/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -80,5 +80,11 @@
 		"watch": "chokidar \"**/*.scss\" -c \"npm run build\" --initial",
 		"lint:scss": "stylelint **/*.scss",
 		"lint-fix:scss": "stylelint **/*.scss --fix"
+	},
+	"allowScripts": {
+		"@parcel/watcher": false,
+		"core-js": false,
+		"core-js-pure": false,
+		"fsevents": false
 	}
 }
diff --git a/src/wp-content/themes/twentytwentytwo/.npmrc b/src/wp-content/themes/twentytwentytwo/.npmrc
new file mode 100644
index 0000000000000..ab08bbe0fad23
--- /dev/null
+++ b/src/wp-content/themes/twentytwentytwo/.npmrc
@@ -0,0 +1,4 @@
+# fail the install on any dependency script not covered by allowScripts in package.json
+strict-allow-scripts = true
+# npm v12 already refuses git and remote URL dependencies; extend that to local tarballs
+allow-file = none
diff --git a/src/wp-content/themes/twentytwentytwo/package-lock.json b/src/wp-content/themes/twentytwentytwo/package-lock.json
index ffde012248aad..b946e91812ea6 100644
--- a/src/wp-content/themes/twentytwentytwo/package-lock.json
+++ b/src/wp-content/themes/twentytwentytwo/package-lock.json
@@ -16,7 +16,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=12.2.0"
 			}
 		},
 		"node_modules/@wordpress/browserslist-config": {
diff --git a/src/wp-content/themes/twentytwentytwo/package.json b/src/wp-content/themes/twentytwentytwo/package.json
index 33c5b10d58eb1..f3808c5854ad1 100644
--- a/src/wp-content/themes/twentytwentytwo/package.json
+++ b/src/wp-content/themes/twentytwentytwo/package.json
@@ -14,7 +14,7 @@
 	"homepage": "https://wordpress.org/themes/twentytwentytwo/",
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=12.2.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -23,7 +23,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=12.2.0",
 			"onFail": "error"
 		}
 	},
@@ -39,5 +39,8 @@
   "scripts": {
     "build": "postcss style.css --use cssnano -o style.min.css --no-map",
     "watch": "postcss style.css --use cssnano -o style.min.css --no-map --watch"
-  }
+  },
+	"allowScripts": {
+		"fsevents": false
+	}
 }