fix(docker): decouple pnpm bootstrap from the package registry

.env.example

@@ -28,6 +28,12 @@
 # your shell before running docker compose (do NOT put it in .env, which
 # worktree-env regenerates per-worktree):
 #   export NPM_CONFIG_REGISTRY=https://packagefeedproxy.microsoft.io/npm/
+#
+# NPM_CONFIG_REGISTRY configures ordinary npm/pnpm package resolution only. It
+# is not automatically reused for Corepack's per-version metadata requests.
+# If your network provides a separate Corepack-compatible metadata endpoint,
+# opt into it explicitly before the same one-command build:
+#   export COREPACK_NPM_REGISTRY=https://registry.npmjs.org/
 
 # ---------------------------------------------------------------------------
 # CLI Configuration

ENV_VARIABLES.md

@@ -16,6 +16,48 @@ derives a localhost URL from `SCOPE_API_PORT` or uses `SCOPE_DEFAULT_API_URL`.
 
 ## Docker Development
 
+### NPM_CONFIG_REGISTRY
+**Default:** host npm registry for `pnpm docker:*`; otherwise `https://registry.npmjs.org/`
+**Type:** HTTP(S) URL
+
+Registry used for ordinary npm and pnpm package installation in Docker image
+builds. `scripts/dev-compose.sh` reads the host setting with
+`npm config get registry`, so a private package proxy remains a one-command
+workflow:
+
+```bash
+NPM_CONFIG_REGISTRY=https://packages.example.test/npm/ pnpm docker:dev:copilot
+```
+
+Trailing slashes are normalized during the pinned pnpm bootstrap. Registry URLs
+may point at authenticated/private package services, but credentials must be
+provided through the environment's standard npm authentication mechanism rather
+than embedded in the URL or build args. Credential-bearing URLs are rejected,
+and bootstrap diagnostics report only the endpoint origin.
+
+This setting is deliberately **not** copied to `COREPACK_NPM_REGISTRY`: package
+proxies that serve npm packuments are not necessarily compatible with
+Corepack's per-version metadata protocol.
+
+### COREPACK_NPM_REGISTRY
+**Default:** unset (Corepack's public default)
+**Type:** optional HTTP(S) URL
+
+Corepack-compatible metadata endpoint used only to bootstrap the pinned pnpm
+version in Docker images. Set it explicitly only when the endpoint supports
+Corepack metadata:
+
+```bash
+COREPACK_NPM_REGISTRY=https://corepack.example.test/ \
+  NPM_CONFIG_REGISTRY=https://packages.example.test/npm/ \
+  pnpm docker:dev:copilot
+```
+
+If Corepack fails, the pinned npm fallback uses `NPM_CONFIG_REGISTRY` and clears
+the Corepack override, keeping the two paths in separate failure domains. Normal
+`pnpm install` keeps pnpm's built-in package-fetch retries; Scope does not wrap
+it in an outer retry loop.
+
 ### API_DEBUG_PORT
 **Default:** `9200`
 **Type:** integer (Docker Compose development only)

apps/api/Dockerfile

@@ -1,12 +1,9 @@
 FROM node:22.22.0-slim AS builder
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -16,7 +13,7 @@ COPY packages/telemetry/package.json ./packages/telemetry/
 COPY packages/db-migrations/package.json ./packages/db-migrations/
 COPY apps/api/package.json ./apps/api/
 
-RUN pnpm install --frozen-lockfile
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile
 
 COPY packages/shared/tsconfig.json ./packages/shared/
 COPY packages/shared/src ./packages/shared/src/
@@ -47,12 +44,9 @@ CMD ["/app/scripts/dev-entrypoint.sh"]
 FROM node:22.22.0-slim
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -61,7 +55,7 @@ COPY packages/telemetry/package.json ./packages/telemetry/
 COPY packages/db-migrations/package.json ./packages/db-migrations/
 COPY apps/api/package.json ./apps/api/
 
-RUN pnpm install --frozen-lockfile --prod
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --prod
 
 COPY --from=builder /app/packages/shared/dist ./packages/shared/dist/
 COPY --from=builder /app/packages/telemetry/dist ./packages/telemetry/dist/

apps/judge/Dockerfile

@@ -7,12 +7,9 @@ FROM node:22.22.0-slim AS builder
 # "fetch failed" / "No CA certificates were loaded from the system".
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -21,7 +18,7 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/telemetry/package.json ./packages/telemetry/
 COPY apps/judge/package.json ./apps/judge/
 
-RUN pnpm install --frozen-lockfile
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile
 
 COPY packages/shared/tsconfig.json ./packages/shared/
 COPY packages/shared/src ./packages/shared/src/
@@ -47,20 +44,17 @@ FROM node:22.22.0-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/shared/package.json ./packages/shared/
 COPY packages/telemetry/package.json ./packages/telemetry/
 COPY apps/judge/package.json ./apps/judge/
 
-RUN pnpm install --frozen-lockfile --prod
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --prod
 
 COPY --from=builder /app/packages/shared/dist ./packages/shared/dist/
 COPY --from=builder /app/packages/telemetry/dist ./packages/telemetry/dist/

apps/model-scanners/anthropic/Dockerfile

@@ -1,12 +1,9 @@
 FROM node:22.22.0-slim AS builder
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -16,7 +13,7 @@ COPY packages/telemetry/package.json ./packages/telemetry/
 COPY packages/model-scanning/package.json ./packages/model-scanning/
 COPY apps/model-scanners/anthropic/package.json ./apps/model-scanners/anthropic/
 
-RUN pnpm install --frozen-lockfile
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile
 
 COPY packages/shared/tsconfig.json ./packages/shared/
 COPY packages/shared/src ./packages/shared/src/
@@ -34,12 +31,9 @@ FROM node:22.22.0-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -48,7 +42,7 @@ COPY packages/telemetry/package.json ./packages/telemetry/
 COPY packages/model-scanning/package.json ./packages/model-scanning/
 COPY apps/model-scanners/anthropic/package.json ./apps/model-scanners/anthropic/
 
-RUN pnpm install --frozen-lockfile --prod
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --prod
 
 COPY --from=builder /app/packages/shared/dist ./packages/shared/dist/
 COPY --from=builder /app/packages/telemetry/dist ./packages/telemetry/dist/

apps/model-scanners/copilot/Dockerfile

@@ -1,12 +1,9 @@
 FROM node:22.22.0-slim AS builder
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -16,7 +13,7 @@ COPY packages/telemetry/package.json ./packages/telemetry/
 COPY packages/model-scanning/package.json ./packages/model-scanning/
 COPY apps/model-scanners/copilot/package.json ./apps/model-scanners/copilot/
 
-RUN pnpm install --frozen-lockfile
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile
 
 COPY packages/shared/tsconfig.json ./packages/shared/
 COPY packages/shared/src ./packages/shared/src/
@@ -34,12 +31,9 @@ FROM node:22.22.0-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -48,7 +42,7 @@ COPY packages/telemetry/package.json ./packages/telemetry/
 COPY packages/model-scanning/package.json ./packages/model-scanning/
 COPY apps/model-scanners/copilot/package.json ./apps/model-scanners/copilot/
 
-RUN pnpm install --frozen-lockfile --prod
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --prod
 
 COPY --from=builder /app/packages/shared/dist ./packages/shared/dist/
 COPY --from=builder /app/packages/telemetry/dist ./packages/telemetry/dist/

apps/portal/Dockerfile

@@ -1,16 +1,13 @@
 # Shared Portal dependency layer
 FROM node:20-alpine AS deps
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
 COPY apps/portal/package.json apps/portal/
-RUN pnpm install --frozen-lockfile --filter portal --prod=false
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --filter portal --prod=false
 
 # --- Dev stage: Vite dev server with HMR ---
 # Built from `deps` (not `builder`) so the dev image skips the production build.

apps/scheduler/Dockerfile

@@ -1,12 +1,9 @@
 FROM node:22.22.0-slim AS builder
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -15,7 +12,7 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/telemetry/package.json ./packages/telemetry/
 COPY apps/scheduler/package.json ./apps/scheduler/
 
-RUN pnpm install --frozen-lockfile
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile
 
 COPY packages/shared/tsconfig.json ./packages/shared/
 COPY packages/shared/src ./packages/shared/src/
@@ -43,20 +40,17 @@ CMD ["/app/scripts/dev-entrypoint.sh"]
 FROM node:22.22.0-slim
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/shared/package.json ./packages/shared/
 COPY packages/telemetry/package.json ./packages/telemetry/
 COPY apps/scheduler/package.json ./apps/scheduler/
 
-RUN pnpm install --frozen-lockfile --prod
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --prod
 
 COPY --from=builder /app/packages/shared/dist ./packages/shared/dist/
 COPY --from=builder /app/packages/telemetry/dist ./packages/telemetry/dist/

apps/token-manager/Dockerfile

@@ -1,12 +1,9 @@
 FROM node:22.22.0-slim AS builder
 
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
@@ -15,7 +12,7 @@ COPY packages/shared/package.json ./packages/shared/
 COPY packages/telemetry/package.json ./packages/telemetry/
 COPY apps/token-manager/package.json ./apps/token-manager/
 
-RUN pnpm install --frozen-lockfile
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile
 
 COPY packages/shared/tsconfig.json ./packages/shared/
 COPY packages/shared/src ./packages/shared/src/
@@ -40,20 +37,17 @@ FROM node:22.22.0-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
 ARG NPM_CONFIG_REGISTRY=https://registry.npmjs.org/
-ENV npm_config_registry=${NPM_CONFIG_REGISTRY} \
-    COREPACK_NPM_REGISTRY=${NPM_CONFIG_REGISTRY}
-# corepack bootstraps pnpm from the registry's per-version metadata endpoint,
-# which some private registry proxies don't serve; fall back to a pinned global
-# install (honors npm_config_registry) so restricted networks can still build.
-RUN corepack enable && (corepack prepare pnpm@10.29.1 --activate || npm install -g pnpm@10.29.1 --force)
+ARG COREPACK_NPM_REGISTRY=
+COPY scripts/bootstrap-pnpm.sh /usr/local/bin/bootstrap-pnpm
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY}" sh /usr/local/bin/bootstrap-pnpm
 WORKDIR /app
 
 COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
 COPY packages/shared/package.json ./packages/shared/
 COPY packages/telemetry/package.json ./packages/telemetry/
 COPY apps/token-manager/package.json ./apps/token-manager/
 
-RUN pnpm install --frozen-lockfile --prod
+RUN NPM_CONFIG_REGISTRY="${NPM_CONFIG_REGISTRY}" pnpm install --frozen-lockfile --prod
 
 COPY --from=builder /app/packages/shared/dist ./packages/shared/dist/
 COPY --from=builder /app/packages/telemetry/dist ./packages/telemetry/dist/