diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..f7e3fc3
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,8 @@
+# The frontgen build pod cannot reach the npm audit endpoint: a GET to
+# registry.npmjs.org is fast, but the POST to /-/npm/v1/security/advisories/bulk
+# never answers. `npm install` therefore finished in ~10s and then hung on the
+# audit until frontgen's 300s BUILD_TIMEOUT SIGKILLed it, so no build has been
+# deployed since 29 Jul. Skipping the audit is the fix on our side; the real
+# repair is --no-audit in frontgen's builder (internal/builder/build.go).
+audit=false
+fund=false