diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..6931e1e
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,14 @@
+# pnpm settings live here, not in .npmrc and not in the `pnpm` field of package.json —
+# pnpm 10 stopped reading that field and only warned about it.
+
+# Nothing here is installed until it is at least a day old. This is a supply-chain
+# control, not a tidiness rule: the npm attacks that actually hurt people publish a
+# compromised version of a real package and rely on automation to pull it into a build
+# within minutes. Setting this to 0 to make a red build go green removes the protection
+# at exactly the moment it is worth the most — wait instead.
+#
+# 1440 minutes is pnpm's default, declared explicitly so that it is a decision which can
+# be reported as drift rather than one inherited silently. One value across every
+# rtldev-middleware repository, enforced by node-policy.sh in the workspace repository.
+# (RSRMID-3018)
+minimumReleaseAge: 1440