diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 6f27846..602adb0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -33,6 +33,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # The runner's pnpm is not necessarily the workstation's, and this
+      # setting moved location between 10.x releases. Print what it actually
+      # resolves to, so a failure here is diagnosable from the log rather than
+      # by pushing another guess.
+      - name: pnpm environment
+        working-directory: web
+        run: |
+          pnpm --version
+          pnpm config get --json onlyBuiltDependencies || true
+          pnpm config list || true
+
       - name: install
         working-directory: web
         run: pnpm install --frozen-lockfile
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 76742e8..ecda86c 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -61,6 +61,17 @@ jobs:
 
       # The gate for the frontend, matching the Rust one: a type error or a
       # lint failure must not reach a host either.
+      # The runner's pnpm is not necessarily the workstation's, and this
+      # setting moved location between 10.x releases. Print what it actually
+      # resolves to, so a failure here is diagnosable from the log rather than
+      # by pushing another guess.
+      - name: pnpm environment
+        working-directory: web
+        run: |
+          pnpm --version
+          pnpm config get --json onlyBuiltDependencies || true
+          pnpm config list || true
+
       - name: install
         working-directory: web
         run: pnpm install --frozen-lockfile
diff --git a/web/package.json b/web/package.json
index a89b13c..0bfde7b 100644
--- a/web/package.json
+++ b/web/package.json
@@ -32,5 +32,11 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@swc/core",
+      "esbuild"
+    ]
   }
 }
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
index 686c4ae..d820102 100644
--- a/web/pnpm-workspace.yaml
+++ b/web/pnpm-workspace.yaml
@@ -1,9 +1,12 @@
-# pnpm 10 reads settings from here, not from package.json's `pnpm` field.
+# The allowlist of dependencies permitted to run install scripts. Both fetch a
+# platform-native binary; every other package in the tree is denied, which is
+# the point -- an install script is arbitrary code from a transitive dependency.
 #
-# An explicit allowlist of dependencies permitted to run install scripts. Both
-# fetch a platform-native binary at install time and do not work without it;
-# every other package in the tree is denied, which is the point — an install
-# script is arbitrary code from a transitive dependency.
+# Declared here *and* in package.json's `pnpm` field on purpose: pnpm moved
+# this setting between 10.x releases, and the workstation and the CI runner do
+# not carry the same version. Whichever one is authoritative, it finds the same
+# list, and the duplication is four lines against a failure that only shows up
+# on the runner.
 onlyBuiltDependencies:
   - '@swc/core'
   - esbuild