diff --git a/.npmrc b/.npmrc
index e542392f..f0549c63 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,2 +1,5 @@
 # Prevent supply chain attacks
 min-release-age=7
+# Stop `npx` from silently downloading packages not in node_modules.
+# Equivalent to passing `--no` to every `npx` invocation.
+yes=false