diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..aa9e5f4
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,8 @@
+# npm 12 changed the default of `allow-git` from permissive to `none`, which
+# breaks `npm ci` for this project: the StartOS SDK ecosystem ships packages
+# over git rather than the public registry.
+#
+# `all` rather than `root` is required. `root` would only cover git deps named
+# in our own package.json (bitcoin-core-startos); tor-startos is a transitive
+# git dep pulled in by it, and `root` refuses those.
+allow-git=all