diff --git a/docs/contributing.md b/docs/contributing.md
index 96cda83..524aaf9 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -96,6 +96,7 @@ Examples are runtime-isolated demos. Each one installs the packed `@variablelab/
    ```jsonc
    "@variablelab/env": "file:../../package/.local/variablelab-env.tgz"
    ```
+   A pnpm example also copies the `.npmrc` from an existing pnpm example.
 3. Add a `mise.toml` with the runtime tools (`node`, `bun`, `deno` or `pnpm`) and the standard tasks (`setup`, `start`, `test:e2e`, `check`). Use the existing example with the closest runtime as a template.
 4. Add a `biome.json` extending `@rrlab/biome-config`, except in a Deno-only example.
 5. Add the path to `[monorepo].config_roots` in the root [`mise.toml`](../mise.toml).
diff --git a/docs/development.md b/docs/development.md
index b207a56..047039f 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -281,7 +281,7 @@ Avoid `for d in examples/*/; do ...; done`: it runs one example at a time and pr
 
 ### pnpm tries to install across the whole monorepo from inside an example
 
-The example directories sit inside the same tree as `pnpm-workspace.yaml`, so pnpm takes them for workspace members. They aren't, but pnpm needs an explicit `--ignore-workspace` to honor that. The pnpm-based examples already pass it in their `setup` tasks, and a new pnpm-based example has to do the same.
+The example directories sit inside the same tree as `pnpm-workspace.yaml`, so pnpm takes them for workspace members. They aren't, but pnpm needs an explicit `--ignore-workspace` to honor that. The pnpm-based examples already pass it in their `setup` tasks, and a new pnpm-based example has to do the same. `--ignore-workspace` also skips the cooldown in `pnpm-workspace.yaml`, so each pnpm-based example has an `.npmrc` with the same settings, and a new one copies it.
 
 ### Deno can't import the library from the tarball
 
diff --git a/examples/backend-node-cjs/.npmrc b/examples/backend-node-cjs/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/backend-node-cjs/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/backend-node/.npmrc b/examples/backend-node/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/backend-node/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/edge-nextjs/.npmrc b/examples/edge-nextjs/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/edge-nextjs/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/spa-vite-dynamic/.npmrc b/examples/spa-vite-dynamic/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/spa-vite-dynamic/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/spa-vite-plugin/.npmrc b/examples/spa-vite-plugin/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/spa-vite-plugin/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/ssr-react-router/.npmrc b/examples/ssr-react-router/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/ssr-react-router/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/ssr-tanstack-start/.npmrc b/examples/ssr-tanstack-start/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/ssr-tanstack-start/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/examples/worker-cloudflare/.npmrc b/examples/worker-cloudflare/.npmrc
new file mode 100644
index 0000000..1f993a3
--- /dev/null
+++ b/examples/worker-cloudflare/.npmrc
@@ -0,0 +1,4 @@
+# Supply-chain cooldown, mirroring pnpm-workspace.yaml: these examples install with --ignore-workspace, which skips it.
+minimum-release-age=1440
+minimum-release-age-exclude[]=@variablelab/*
+minimum-release-age-exclude[]=@rrlab/*
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index c398556..78535e4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -24,6 +24,7 @@ publicHoistPattern:
   - "@total-typescript/*"
 
 # Supply-chain cooldown: malicious releases are usually pulled within 24h; pattern excludes need pnpm >= 10.17.
+# The pnpm examples install with --ignore-workspace, which skips this file, so each carries the same values in its own .npmrc.
 minimumReleaseAge: 1440
 minimumReleaseAgeExclude:
   - "@variablelab/*"