diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..fcbc875
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,5 @@
+# Turn the `engines` field from a warning into a gate. By default a Node
+# version mismatch is only reported as a notice, so an install run under an
+# unpinned Node still succeeds and silently rewrites package-lock.json using
+# that older npm's resolution rules. Refuse the install instead.
+engine-strict=true