diff --git a/.claude/check-code.sh b/.claude/check-code.sh
index c6abba72..0c708916 100755
--- a/.claude/check-code.sh
+++ b/.claude/check-code.sh
@@ -10,7 +10,7 @@ if ! command -v pnpm &>/dev/null; then
 fi
 
 echo "Installing dependencies with pnpm..."
-if ! pnpm -C "$CLAUDE_PROJECT_DIR" install --frozen-lockfile 2>&1; then
+if ! pnpm -C "$CLAUDE_PROJECT_DIR" install --frozen-lockfile --ignore-scripts 2>&1; then
   ERRORS+="Dependency install failed. "
 fi
 
diff --git a/.claude/session-start.sh b/.claude/session-start.sh
index 3ed19c03..9c395d2a 100755
--- a/.claude/session-start.sh
+++ b/.claude/session-start.sh
@@ -14,4 +14,4 @@ fi
 # Install/sync dependencies — always run to ensure node_modules matches the lockfile
 # (e.g. after a dependency version bump, node_modules may exist but be stale)
 echo "Installing dependencies with pnpm..."
-pnpm -C "$CLAUDE_PROJECT_DIR" install --frozen-lockfile
+pnpm -C "$CLAUDE_PROJECT_DIR" install --frozen-lockfile --ignore-scripts
diff --git a/.devcontainer/postCreateCommand.sh b/.devcontainer/postCreateCommand.sh
index b49cf420..930ad130 100755
--- a/.devcontainer/postCreateCommand.sh
+++ b/.devcontainer/postCreateCommand.sh
@@ -2,4 +2,4 @@
 set -x
 
 # Install locked dependencies
-pnpm install --frozen-lockfile
\ No newline at end of file
+pnpm install --frozen-lockfile --ignore-scripts
\ No newline at end of file
diff --git a/.github/workflows/add-contributor.yml b/.github/workflows/add-contributor.yml
index aaa5eb4b..3b620030 100644
--- a/.github/workflows/add-contributor.yml
+++ b/.github/workflows/add-contributor.yml
@@ -34,7 +34,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Configure GIT
         run: |
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
diff --git a/.github/workflows/build-status.yml b/.github/workflows/build-status.yml
index daf17431..66967a21 100644
--- a/.github/workflows/build-status.yml
+++ b/.github/workflows/build-status.yml
@@ -40,7 +40,7 @@ jobs:
           cache: 'pnpm'
       - name: Update pnpm cache
         if: steps.pnpm-cache.outputs.cache-hit != 'true'
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
   warmup_pnpm_cache_others:
     name: 'Warm up pnpm cache (others)'
     if: github.event_name == 'push' || github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' || (github.event.action == 'labeled' && github.event.label.name == 'force-build-status-execution')
@@ -62,7 +62,7 @@ jobs:
           cache: 'pnpm'
       - name: Update pnpm cache
         if: steps.pnpm-cache.outputs.cache-hit != 'true'
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
 
   # Jobs without any strong requirement on warmup_pnpm_cache
   # except that they have to wait for it to avoid setting an empty cache that would replace the one pushed by warmup_pnpm_cache
@@ -119,7 +119,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm --filter @fast-check/monorepo install --frozen-lockfile
+        run: pnpm --filter @fast-check/monorepo install --frozen-lockfile --ignore-scripts
       - name: Check format
         run: node --run format:check
       - name: Check lint
@@ -140,7 +140,7 @@ jobs:
           node-version: '24.x'
           cache: ${{ github.event_name == 'push' && '' || 'pnpm' }}
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Build production packages
         run: node --run build-ci:all
       - name: Create bundles
@@ -172,7 +172,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Download production packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -202,7 +202,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Download production packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -270,7 +270,7 @@ jobs:
           node-version: ${{matrix.node-version}}
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Download production packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -346,7 +346,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm --filter website install --frozen-lockfile
+        run: pnpm --filter website install --frozen-lockfile --ignore-scripts
       - name: Download production packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -396,7 +396,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Download production packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -459,7 +459,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Download production packages
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/pr-format.yml b/.github/workflows/pr-format.yml
index 8ab56a2c..8b01eb76 100644
--- a/.github/workflows/pr-format.yml
+++ b/.github/workflows/pr-format.yml
@@ -40,7 +40,7 @@ jobs:
           node-version: '24.x'
           cache: 'pnpm'
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Check current branch info
         env:
           PR_NUMBER: ${{ github.event.inputs.ref_value }}
diff --git a/.github/workflows/pr-pnpm-conflicts.yml b/.github/workflows/pr-pnpm-conflicts.yml
index d351efbf..8cb69817 100644
--- a/.github/workflows/pr-pnpm-conflicts.yml
+++ b/.github/workflows/pr-pnpm-conflicts.yml
@@ -65,7 +65,7 @@ jobs:
       - name: Regenerate pnpm-lock.yaml
         run: |
           echo "Regenerating pnpm-lock.yaml..."
-          pnpm install --lockfile-only
+          pnpm install --lockfile-only --ignore-scripts
       - name: Commit lock file changes
         env:
           WORKFLOW_NAME: ${{ github.workflow }}