diff --git a/npm/socket-patch/package-lock.json b/npm/socket-patch/package-lock.json
index 987aca5f..0bd34b59 100644
--- a/npm/socket-patch/package-lock.json
+++ b/npm/socket-patch/package-lock.json
@@ -84,9 +84,6 @@
       "cpu": [
         "arm"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -100,9 +97,6 @@
       "cpu": [
         "arm"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -116,9 +110,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -132,9 +123,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -148,9 +136,6 @@
       "cpu": [
         "ia32"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -164,9 +149,6 @@
       "cpu": [
         "ia32"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -180,9 +162,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -196,9 +175,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
diff --git a/scripts/version-sync.sh b/scripts/version-sync.sh
index 3451a9cb..48fde5f7 100755
--- a/scripts/version-sync.sh
+++ b/scripts/version-sync.sh
@@ -38,9 +38,17 @@ node -e "
 # Refresh the npm wrapper lockfile so package-lock.json stays in sync with the
 # bumped package.json (own version, optionalDependencies). Uses --package-lock-only
 # so node_modules is untouched.
+#
+# The npm major is pinned: the lock's byte shape depends on it (npm >= 11 adds
+# `libc` arrays to platform-package entries that npm 10 omits), and
+# release-lint.sh compares the regenerated lock byte-for-byte against the
+# committed one on every PR. An unpinned npm makes that gate depend on
+# whichever npm the runner or developer happens to have. Bumping this pin
+# requires refreshing the committed lock in the same commit.
+NPM_LOCK_REFRESH_VERSION="10"
 (
   cd "$REPO_ROOT/npm/socket-patch"
-  npm install --package-lock-only --ignore-scripts >/dev/null
+  npx --yes "npm@$NPM_LOCK_REFRESH_VERSION" install --package-lock-only --ignore-scripts >/dev/null
 )
 
 # Update all per-platform npm package versions