diff --git a/.github/workflows/reusable-extension-ci.yml b/.github/workflows/reusable-extension-ci.yml
index 13f7832..7bb61bc 100644
--- a/.github/workflows/reusable-extension-ci.yml
+++ b/.github/workflows/reusable-extension-ci.yml
@@ -144,11 +144,11 @@ jobs:
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         # Version pinned for reproducibility (this runs at release time, so avoid a surprise major bump).
-        # Note: --allow-scripts=snyk (npm 12 blocks install scripts by default) because snyk's postinstall
-        # bootstraps its CLI binary; without it the binary is lazily downloaded on first run instead.
+        # Note: --ignore-scripts satisfies Sonar and npm 12 script blocking; snyk then lazily downloads
+        # its CLI binary on first run instead of in a postinstall (verified working).
         run: |
-          npm install -g npm@12.0.2
-          npm install -g --allow-scripts=snyk snyk@1.1306.1
+          npm install -g --ignore-scripts npm@12.0.2
+          npm install -g --ignore-scripts snyk@1.1306.1
           snyk test --org=${{ vars.SNYK_ORG_ID }} --severity-threshold=high --project-name=${{ github.repository }} --target-reference=${{ github.ref_name }}
 
       - name: Download e2e coverage files
@@ -443,7 +443,7 @@ jobs:
 
       # this commit will effectively cause another run of the workflow which then actually performs the helm chart release
       - run: |
-          npm install -g npm@12.0.2
+          npm install -g --ignore-scripts npm@12.0.2
           npm install --ignore-scripts -g semver@7.8.1
           make chart-bump-version APP_VERSION="${{ needs.build-images.outputs.version }}"
           git config user.name "$GITHUB_ACTOR"