diff --git a/.yarnrc.yml b/.yarnrc.yml
index 8a5324fe..5b8cbc12 100644
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1,6 +1,6 @@
 compressionLevel: mixed
 
-enableScripts: true
+enableScripts: false
 
 nodeLinker: node-modules
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a61ee7fa..51aa7cc7 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -177,6 +177,23 @@ Links:
 yarn upgrade-interactive
 ```
 
+Install scripts are disabled by default (`enableScripts: false` in `.yarnrc.yml`), so a
+compromised dependency cannot run code just by being installed. Packages that genuinely need
+to build something at install time are opted in individually under `dependenciesMeta` in
+`package.json`.
+
+If an install prints `YN0004: <package> lists build scripts, but all build scripts have been
+disabled`, decide whether that package really needs to build. If it does, add it:
+
+```json
+"dependenciesMeta": {
+  "<package>": { "built": true }
+}
+```
+
+Ignoring the warning leaves the package unbuilt, which usually surfaces later as a confusing
+runtime failure rather than an install error.
+
 ### i18n strings / Weblate
 
 Run `yarn scan-i18n` to get the newest English strings and push so Weblate gets them.
diff --git a/package.json b/package.json
index 93037d19..9c87e810 100644
--- a/package.json
+++ b/package.json
@@ -161,6 +161,17 @@
     "yargs-parser": "^22.0.0",
     "zod": "^4.4.3"
   },
+  "dependenciesMeta": {
+    "@parcel/watcher": {
+      "built": true
+    },
+    "@swc/core": {
+      "built": true
+    },
+    "esbuild": {
+      "built": true
+    }
+  },
   "build": {
     "toolsets": {
       "appimage": "1.0.3"
diff --git a/yarn.lock b/yarn.lock
index 92eca2f7..0ca38453 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9957,6 +9957,13 @@ __metadata:
     yargs: "npm:^18.0.0"
     yargs-parser: "npm:^22.0.0"
     zod: "npm:^4.4.3"
+  dependenciesMeta:
+    "@parcel/watcher":
+      built: true
+    "@swc/core":
+      built: true
+    esbuild:
+      built: true
   languageName: unknown
   linkType: soft