diff --git a/.github/actions/npm-publish/action.yml b/.github/actions/npm-publish/action.yml
index 57679d5c..f945d4b7 100644
--- a/.github/actions/npm-publish/action.yml
+++ b/.github/actions/npm-publish/action.yml
@@ -28,7 +28,11 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      run: npm ci --include=dev
+      # replace-registry-host=always forces npm to resolve every tarball from the
+      # public registry configured above, ignoring any private-registry host that
+      # may have leaked into package-lock.json's "resolved" URLs (which would
+      # otherwise fail with E401). See npm docs: config/replace-registry-host.
+      run: npm ci --include=dev --replace-registry-host=always
 
     - name: Build package
       if: inputs.require-build == 'true'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a660f9f0..bf05ba84 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,12 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 18
-      - run: npm ci --ignore-scripts
+          registry-url: 'https://registry.npmjs.org'
+      # replace-registry-host=always forces npm to resolve every tarball from the
+      # public registry above, ignoring any private-registry host that may have
+      # leaked into package-lock.json's "resolved" URLs (which would otherwise
+      # fail in public CI with E401). See npm docs: config/replace-registry-host.
+      - run: npm ci --ignore-scripts --replace-registry-host=always
       - run: npm run lint
       - run: npm run build
       - run: npm run test:ci
diff --git a/package-lock.json b/package-lock.json
index f02f4e68..79a133ce 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6623,7 +6623,7 @@
     },
     "node_modules/core-js": {
       "version": "3.48.0",
-      "resolved": "https://a0us.jfrog.io/artifactory/api/npm/npm/core-js/-/core-js-3.48.0.tgz",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
       "integrity": "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==",
       "dev": true,
       "hasInstallScript": true,
@@ -22149,7 +22149,7 @@
     },
     "core-js": {
       "version": "3.48.0",
-      "resolved": "https://a0us.jfrog.io/artifactory/api/npm/npm/core-js/-/core-js-3.48.0.tgz",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.48.0.tgz",
       "integrity": "sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==",
       "dev": true
     },