diff --git a/scripts/acpx-patch-packaging.test.mjs b/scripts/acpx-patch-packaging.test.mjs
index b9bc9aa89f..cae9e0eb0a 100644
--- a/scripts/acpx-patch-packaging.test.mjs
+++ b/scripts/acpx-patch-packaging.test.mjs
@@ -295,9 +295,15 @@ test("bundled package dry runs preview without querying published versions", ()
   assert.match(releaseScript, /run_bundled_npm_pack pack --pack-destination "\$publish_dir"/);
   assert.match(releaseLib, /BUNDLED_NPM_PACK_VERSION="10\.9\.7"/);
   assert.match(releaseLib, /BUNDLED_NPM_PUBLISH_VERSION="11\.18\.0"/);
-  assert.match(releaseLib, /npx --yes "npm@\$BUNDLED_NPM_PACK_VERSION"/);
-  assert.match(releaseLib, /npx --yes "npm@\$BUNDLED_NPM_PUBLISH_VERSION"/);
-  assert.match(releaseLib, /"\$@" --loglevel verbose/);
+  assert.match(
+    releaseLib,
+    /npx --yes "npm@\$BUNDLED_NPM_PACK_VERSION" "\$@" --ignore-scripts/,
+  );
+  assert.match(
+    releaseLib,
+    /npx --yes "npm@\$BUNDLED_NPM_PUBLISH_VERSION" "\$@" --ignore-scripts/,
+  );
+  assert.match(releaseLib, /"\$@" --ignore-scripts --loglevel verbose/);
   assert.match(releaseLib, /run_bundled_npm_publish publish --tag "\$dist_tag"/);
   assert.doesNotMatch(releaseLib, /run_bundled_npm_publish publish "\.\/\$tarball"/);
 });
diff --git a/scripts/release-lib.sh b/scripts/release-lib.sh
index 6d1c37fe52..5aa5431e90 100644
--- a/scripts/release-lib.sh
+++ b/scripts/release-lib.sh
@@ -336,11 +336,11 @@ BUNDLED_NPM_PACK_VERSION="10.9.7"
 BUNDLED_NPM_PUBLISH_VERSION="11.18.0"
 
 run_bundled_npm_pack() {
-  npx --yes "npm@$BUNDLED_NPM_PACK_VERSION" "$@"
+  npx --yes "npm@$BUNDLED_NPM_PACK_VERSION" "$@" --ignore-scripts
 }
 
 run_bundled_npm_publish() {
-  npx --yes "npm@$BUNDLED_NPM_PUBLISH_VERSION" "$@" --loglevel verbose
+  npx --yes "npm@$BUNDLED_NPM_PUBLISH_VERSION" "$@" --ignore-scripts --loglevel verbose
 }
 
 run_package_publish() {
diff --git a/scripts/release-lib.test.mjs b/scripts/release-lib.test.mjs
index eb6a6efde0..cc51aa7b15 100644
--- a/scripts/release-lib.test.mjs
+++ b/scripts/release-lib.test.mjs
@@ -181,11 +181,11 @@ test("publish_package_to_npm uses trusted publishing from the bundled staging di
   assert.equal(result.status, 0);
   assert.match(
     result.calls,
-    /^npx --yes npm@11\.18\.0 publish --tag canary --access public --loglevel verbose$/m,
+    /^npx --yes npm@11\.18\.0 publish --tag canary --access public --ignore-scripts --loglevel verbose$/m,
   );
   assert.match(
     result.calls,
-    /^npm publish --tag canary --access public --loglevel verbose$/m,
+    /^npm publish --tag canary --access public --ignore-scripts --loglevel verbose$/m,
   );
   assert.doesNotMatch(result.calls, / pack /);
   assert.doesNotMatch(result.calls, /^pnpm publish/m);
@@ -198,7 +198,7 @@ test("publish_package_to_npm retries bundled directory tlog failures without pro
   assert.match(result.calls, /^npm view @paperclipai\/example@1\.2\.3 version$/m);
   assert.match(
     result.calls,
-    /^npm publish --tag canary --access public --provenance=false --loglevel verbose$/m,
+    /^npm publish --tag canary --access public --provenance=false --ignore-scripts --loglevel verbose$/m,
   );
 });