diff --git a/docs/TOOLCHAIN.md b/docs/TOOLCHAIN.md
index 82a8b69..f5805d7 100644
--- a/docs/TOOLCHAIN.md
+++ b/docs/TOOLCHAIN.md
@@ -8,7 +8,7 @@ Questa pagina descrive runtime, comandi e guardrail effettivi di Sentinel.
 | --- | --- | --- |
 | Node.js locale | `24.x`; tipi allineati a Node `24` | `.nvmrc`, `package.json`, `package-lock.json` |
 | Node.js GitHub Actions | `24` | `.github/workflows/sentinel.yml` |
-| npm | lockfile npm | `package-lock.json` |
+| npm | `npm@11.14.1` | `package.json`, `package-lock.json` |
 | TypeScript | `^6.0.3` | `package.json` |
 | Python | non applicabile | nessun runtime Python |
 
diff --git a/package-lock.json b/package-lock.json
index ef57a96..d962251 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -33,7 +33,8 @@
         "vitest": "^4.0.14"
       },
       "engines": {
-        "node": "24.x"
+        "node": "24.x",
+        "npm": ">=11 <12"
       }
     },
     "node_modules/@babel/code-frame": {
diff --git a/package.json b/package.json
index 796d939..ef42067 100644
--- a/package.json
+++ b/package.json
@@ -4,8 +4,10 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": "24.x"
+    "node": "24.x",
+    "npm": ">=11 <12"
   },
+  "packageManager": "npm@11.14.1",
   "bin": {
     "sentinel": "./dist/index.js"
   },