diff --git a/packages/server/src/server/plugins/managed-source.posix.test.ts b/packages/server/src/server/plugins/managed-source.posix.test.ts
index 7b694f1ef3..0a514bb687 100644
--- a/packages/server/src/server/plugins/managed-source.posix.test.ts
+++ b/packages/server/src/server/plugins/managed-source.posix.test.ts
@@ -522,7 +522,9 @@ it("installs and updates only the npm artifacts pinned by the plugin registry",
   const { resolveNpm } = await import("./managed-source/npm.js");
   const npm = await startNpmRegistry(npmPluginPackages());
   const previous = process.env.npm_config_userconfig;
+  const previousAllowRemote = process.env.npm_config_allow_remote;
   process.env.npm_config_userconfig = npm.userconfig;
+  process.env.npm_config_allow_remote = "none";
   const home = await mkdtemp(path.join(tmpdir(), "paseo-registry-npm-"));
   roots.push(home);
   const intents: Array<string | string[] | undefined> = [];
@@ -573,5 +575,7 @@ it("installs and updates only the npm artifacts pinned by the plugin registry",
     await npm.close();
     if (previous === undefined) delete process.env.npm_config_userconfig;
     else process.env.npm_config_userconfig = previous;
+    if (previousAllowRemote === undefined) delete process.env.npm_config_allow_remote;
+    else process.env.npm_config_allow_remote = previousAllowRemote;
   }
 }, 30_000);
diff --git a/packages/server/src/server/plugins/managed-source/npm.ts b/packages/server/src/server/plugins/managed-source/npm.ts
index 315bbc981e..9f1aa29e99 100644
--- a/packages/server/src/server/plugins/managed-source/npm.ts
+++ b/packages/server/src/server/plugins/managed-source/npm.ts
@@ -57,6 +57,7 @@ export async function acquireNpm(source: string, installRoot: string, target?: N
     [
       "install",
       "--ignore-scripts",
+      "--allow-remote=root",
       "--legacy-peer-deps",
       "--no-audit",
       "--no-fund",
diff --git a/scripts/test-support/npm-registry.mts b/scripts/test-support/npm-registry.mts
index 5640487049..774ac7d1d8 100644
--- a/scripts/test-support/npm-registry.mts
+++ b/scripts/test-support/npm-registry.mts
@@ -71,12 +71,12 @@ export async function startNpmRegistry(packages: FixturePackage[]) {
     // Pack all fixtures in one npm process instead of paying startup once per package.
     const { stdout } = await execCommand(
       "npm",
-      ["pack", "--ignore-scripts", "--json", ...prepared.map(({ directory }) => directory)],
+      ["pack", "--ignore-scripts", ...prepared.map(({ directory }) => directory)],
       { cwd: root },
     );
-    const packed: Array<{ filename: string }> = JSON.parse(stdout);
+    const packed = stdout.trim().split(/\r?\n/);
     for (const { manifest, pkg, index } of prepared) {
-      const artifact = await readFile(path.join(root, packed[index].filename));
+      const artifact = await readFile(path.join(root, packed[index]));
       const artifactPath = `/artifacts/${index}.tgz`;
       artifacts.set(artifactPath, artifact);
       const published = {