diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f4e1e2df7..092393d01 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -194,9 +194,10 @@ jobs:
       - name: Install node deps
         run: bun install
       # No turbo cache: published artifacts are always built from source.
-      # Ensure npm >= 11.15.0 for OIDC/provenance
+      # npm >= 11.15.0 for OIDC/provenance. Pinned to 11: npm 12 changed CLI output
+      # (e.g. `npm pack --json`) that release tooling reads.
       - name: Update npm
-        run: npm install -g npm@latest
+        run: npm install -g npm@^11.15.0
 
       # Native helpers: binaries built, signed, and notarized earlier in this run
       # for helpers this publish releases; the published version pinned by varlock
diff --git a/scripts/fetch-native-helpers.ts b/scripts/fetch-native-helpers.ts
index 28cfa9d30..fedf0a308 100644
--- a/scripts/fetch-native-helpers.ts
+++ b/scripts/fetch-native-helpers.ts
@@ -70,8 +70,11 @@ for (const suffix of platforms) {
 
   const workDir = path.join(tmp, suffix);
   fs.mkdirSync(workDir);
-  const [packed] = JSON.parse(npm(['pack', spec, '--json'], workDir));
-  execFileSync('tar', ['-xzf', packed.filename], { cwd: workDir });
+  // don't parse `npm pack --json`: npm 12 changed it from an array to an object keyed by name
+  npm(['pack', spec], workDir);
+  const tarballs = fs.readdirSync(workDir).filter((f) => f.endsWith('.tgz'));
+  if (tarballs.length !== 1) throw new Error(`expected one tarball from npm pack ${spec}, found: ${tarballs.join(', ') || 'none'}`);
+  execFileSync('tar', ['-xzf', tarballs[0]!], { cwd: workDir });
 
   const entry = SUBDIR_CONTENTS[suffix];
   const destDir = path.join(DEST, suffix);