diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77f6e94..3e72877 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
       - main
 
 permissions:
-  contents: read # checkout
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ed7f5fd..5a9c5c4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write # npm trusted publishing (OIDC)
-      contents: read # checkout
+      contents: read
     steps:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write # npm trusted publishing (OIDC)
-      contents: read # checkout
+      contents: read
     outputs:
       packages: ${{ steps.preview.outputs.packages }}
     steps:
@@ -99,6 +99,7 @@ jobs:
           mode: publish
           # Explicit: an .npmrc would make preview-release default to token mode.
           publish_mode: oidc-only
+
   preview-comment:
     name: Comment preview
     needs: preview
diff --git a/.github/workflows/workflow-audit.yml b/.github/workflows/workflow-audit.yml
index 7519d11..822824f 100644
--- a/.github/workflows/workflow-audit.yml
+++ b/.github/workflows/workflow-audit.yml
@@ -7,7 +7,7 @@ on:
       - main
 
 permissions:
-  contents: read # checkout
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.npmrc b/.npmrc
index 36f3e84..56cff41 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,18 +1,2 @@
-# Supply-chain guard: never resolve a dependency version published less than
-# 24 h ago (most malicious releases are pulled within the first hour). Requires
-# pnpm >= 10.16.
-#
-# No exclude list on purpose: our own scopes (@variablelab/*, @rrlab/*) wait
-# 24 h too. In .npmrc, `minimum-release-age-exclude[]` breaks whenever pnpm is
-# launched through npm (`npx pnpm`, `npm exec`, `npm run`). npm re-exports the
-# array as a single string, and pnpm 10.30.3 then exempts every package. To
-# adopt a fresh own release right away, pass
-# `--config.minimum-release-age=0` to that one `pnpm add`.
-#
-# This lives here instead of pnpm-workspace.yaml because @rrlab/cli (through
-# @vlandoss/clibuddy 0.7.1) treats any repo with a pnpm-workspace.yaml as a
-# monorepo, and `rr tsc` then fails ("Invalid workspace patterns") or, with
-# `packages: ["."]`, silently skips this package. Once
-# https://github.com/withvariablelab/dx/issues/249 ships, move it there with
-# minimumReleaseAgeExclude, and delete this file.
+# In .npmrc, not pnpm-workspace.yaml, until withvariablelab/dx#249 ships; no exclude list (breaks under npm exec).
 minimum-release-age=1440