diff --git a/lib/runtime.func b/lib/runtime.func
index 5f777e0..e932b41 100644
--- a/lib/runtime.func
+++ b/lib/runtime.func
@@ -1550,16 +1550,20 @@ setup_nodejs() {
 
   # npm 11+ skips install hooks not covered by allowScripts and still exits 0,
   # so apps with native addons install with nothing built.
-  local npm_major
+  # npm reads the global npmrc from <prefix>/etc, so `npm --prefix /opt/app`
+  # never sees it; the user npmrc applies whatever the prefix.
+  local npm_major npm_location
   npm_major="$(npm -v 2>/dev/null | cut -d. -f1)" || npm_major=""
-  if [[ "$npm_major" -ge 11 ]]; then
-    $STD npm config set dangerously-allow-all-scripts true --location=global 2>/dev/null || true
-  fi
-  # npm 12 refuses git and tarball-URL dependencies by default (EALLOWGIT/EALLOWREMOTE).
-  if [[ "$npm_major" -ge 12 ]]; then
-    $STD npm config set allow-git all --location=global 2>/dev/null || true
-    $STD npm config set allow-remote all --location=global 2>/dev/null || true
-  fi
+  for npm_location in global user; do
+    if [[ "$npm_major" -ge 11 ]]; then
+      $STD npm config set dangerously-allow-all-scripts true --location="$npm_location" 2>/dev/null || true
+    fi
+    # npm 12 refuses git and tarball-URL dependencies by default (EALLOWGIT/EALLOWREMOTE).
+    if [[ "$npm_major" -ge 12 ]]; then
+      $STD npm config set allow-git all --location="$npm_location" 2>/dev/null || true
+      $STD npm config set allow-remote all --location="$npm_location" 2>/dev/null || true
+    fi
+  done
 
   # Set a safe default heap limit for Node.js builds if not explicitly provided.
   # Priority: