diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a70035b460..9a3ea2ef5c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -92,11 +92,12 @@ jobs:
         name: "Initialize NPM Configuration"
         run: |
           npmAuthToken="${{ env.NODE_AUTH_TOKEN }}"
-          echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${npmAuthToken}" >> .npmrc
-          echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          # We must not commit this change.
-          git update-index --assume-unchanged .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          {
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${npmAuthToken}"
+          } > .npmrc
       - id: installPnpm
         name: "Install: Use PNPM ${{ env.pnpmVersion }}"
         uses: pnpm/action-setup@v5
diff --git a/.github/workflows/deploy-storybook.yml b/.github/workflows/deploy-storybook.yml
index 3aceb2a983..64723c82ee 100644
--- a/.github/workflows/deploy-storybook.yml
+++ b/.github/workflows/deploy-storybook.yml
@@ -76,11 +76,12 @@ jobs:
           npmUrl="${{ env.npmUrl }}"
           npmAuthToken="${{ env.NODE_AUTH_TOKEN }}"
 
-          echo "//${npmHost}/:_authToken=${npmAuthToken}" >> .npmrc
-          echo "@coremedia:registry=${npmUrl}" >> .npmrc
-          echo "@coremedia-internal:registry=${npmUrl}" >> .npmrc
-          # We must not commit this change.
-          git update-index --assume-unchanged .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          {
+            echo "@coremedia:registry=${npmUrl}"
+            echo "@coremedia-internal:registry=${npmUrl}"
+            echo "//${npmHost}/:_authToken=${npmAuthToken}"
+          } > .npmrc
       - id: installPnpm
         name: "Install: Use PNPM ${{ env.pnpmVersion }}"
         uses: pnpm/action-setup@v5
diff --git a/.github/workflows/pre-release-gc.yml b/.github/workflows/pre-release-gc.yml
index d2294cf321..1ae157663d 100644
--- a/.github/workflows/pre-release-gc.yml
+++ b/.github/workflows/pre-release-gc.yml
@@ -57,10 +57,15 @@ jobs:
             exit 1
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
-          echo "PNPM_CONFIG_//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}" >> $GITHUB_ENV
           echo "NPM_AUTH_TOKEN=${NPM_AUTH_TOKEN}" >> $GITHUB_ENV
-          echo "//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}" > .npmrc
-          echo "@coremedia:registry=${{ env.NPM_REPOSITORY_URL }}" >> .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "@coremedia:registry=${{ env.NPM_REPOSITORY_URL }}"
+            echo "//${{ env.NPM_REPOSITORY }}/:_authToken=${NPM_AUTH_TOKEN}"
+          } > .npmrc
       - name: "Performing Garbage Collection (retain: ${{ inputs.retain }}, dry-run: ${{ inputs.dryRun }})"
         run: |
           packages=($(npm search "@coremedia/ckeditor" --json --registry "${{ env.NPM_REPOSITORY_URL }}" | jq -r ".[].name"))
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index ebfbdcedf7..f808af454f 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -54,9 +54,15 @@ jobs:
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
           echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "PNPM_CONFIG_//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
+          } > .npmrc
       - name: Setup Git
         run: |
           git config --global user.name 'coremedia-ci'
@@ -104,7 +110,6 @@ jobs:
         if: github.event_name == 'workflow_dispatch'
         run: |
           pnpm install --production
-          echo '//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
           pnpm publishall --registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/ --no-git-checks --tag pullrequest
       # The "Set prerelease version" step pinned all @coremedia/* interdependencies
       # to concrete versions so they could be published. Now that publishing is done,
@@ -113,8 +118,6 @@ jobs:
       - name: Restore workspace dependency versions
         if: github.event_name == 'workflow_dispatch'
         run: |
-          # Avoid committing the auth token written to .npmrc during publishing.
-          git checkout -- .npmrc || true
           echo "Restoring workspace dependency versions for: ${NEXT_VERSION}"
           pnpm run setversion ${NEXT_VERSION} --filter=coremedia/* --dependencyVersion=workspace:^${NEXT_VERSION}
           pnpm install --no-frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 338b9cf41b..633e76ec70 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,9 +73,15 @@ jobs:
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
           echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "PNPM_CONFIG_//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
-          echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/" >> .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
+          } > .npmrc
       - name: Setup Git
         run: |
           git config --global user.name 'coremedia-ci'
@@ -135,7 +141,6 @@ jobs:
       - name: Publish Release
         if: github.event_name == 'workflow_dispatch'
         run: |
-          echo '//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
           pnpm publishall --registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/ --no-git-checks
           git reset --hard
       # The "Create Release Version" step pinned all @coremedia/* interdependencies
diff --git a/.github/workflows/unpublish.yml b/.github/workflows/unpublish.yml
index ffc709b183..1ed914ce4d 100644
--- a/.github/workflows/unpublish.yml
+++ b/.github/workflows/unpublish.yml
@@ -20,9 +20,16 @@ jobs:
             exit 1
           fi
           echo "::add-mask::$NPM_AUTH_TOKEN"
-          echo "PNPM_CONFIG_//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
           echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
-          echo '//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
+          # The .npmrc is not checked in (see .gitignore) and fully generated here.
+          # pnpm ignores ${VAR} placeholders in registry credentials that come from
+          # a project .npmrc, so the resolved token has to be written out literally.
+          # The file is gitignored and the token is masked in the logs.
+          {
+            echo "@coremedia:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "@coremedia-internal:registry=https://repository.coremedia.com/nexus/repository/coremedia-npm/"
+            echo "//repository.coremedia.com/nexus/repository/coremedia-npm/:_authToken=$NPM_AUTH_TOKEN"
+          } > .npmrc
       - name: Unpublish release
         run: |
           version=${{ github.event.inputs.version }}
diff --git a/.gitignore b/.gitignore
index 628e2219d8..c2f82a7a23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -61,3 +61,12 @@ tmp/
 
 # Results from `pnpm pack` (to test packaging)
 *.tgz
+
+### ----------------------------------------------------------------------------
+### NPM
+### ----------------------------------------------------------------------------
+
+# The .npmrc is generated by the CI workflows (strict-ssl, registry mappings and
+# the Nexus auth token) and must never be committed. Developers may keep their
+# own local variant.
+.npmrc
diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index a49e127804..0000000000
--- a/.npmrc
+++ /dev/null
@@ -1 +0,0 @@
-strict-ssl=false