diff --git a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml
index 75ee46a7..4bb55fb8 100644
--- a/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml
+++ b/.github/skills/bmad-testarch-ci/azure-pipelines-template.yaml
@@ -4,10 +4,17 @@
 # Stack: {test_stack_type} | Framework: {test_framework}
 #
 # Variables to customize per project:
-#   INSTALL_CMD       - dependency install command (e.g., npm ci, pnpm install --frozen-lockfile)
+#   INSTALL_CMD       - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts)
+#                       NOTE: --ignore-scripts skips ALL lifecycle scripts — both dependency scripts (preinstall/postinstall/prepare)
+#                       AND root-package hooks (SonarCloud S6505). For dependencies needing lifecycle scripts, add explicit
+#                       `npm rebuild <pkg>` steps. For root-package scripts (e.g., prepare hooks), run them as separate steps
+#                       (e.g., `npm run prepare` if needed for your stack).
 #   TEST_CMD          - main test command (e.g., npm run test:e2e, npm test, npx vitest)
 #   LINT_CMD          - lint command (e.g., npm run lint)
-#   BROWSER_INSTALL   - browser install command (frontend/fullstack only; omit for backend)
+#   BROWSER_INSTALL   - browser install command using the lockfile-pinned local binary; avoid npx,
+#                       which can resolve an unpinned copy from the npx cache or global bin
+#                       (e.g., ./node_modules/.bin/playwright install --with-deps chromium;
+#                       frontend/fullstack only; omit for backend)
 #   DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24)
 
 trigger:
@@ -51,7 +58,7 @@ stages:
               path: $(npm_config_cache)
             displayName: "Cache npm"
 
-          - script: npm ci
+          - script: npm ci --ignore-scripts
             displayName: "Install dependencies" # Replace with INSTALL_CMD
 
           - script: npm run lint
@@ -90,11 +97,11 @@ stages:
               path: $(npm_config_cache)
             displayName: "Cache npm"
 
-          - script: npm ci
+          - script: npm ci --ignore-scripts
             displayName: "Install dependencies" # Replace with INSTALL_CMD
 
           # Frontend/Fullstack only — skipped for backend-only stacks
-          - script: npx playwright install --with-deps chromium
+          - script: ./node_modules/.bin/playwright install --with-deps chromium
             condition: ne(variables['TEST_STACK_TYPE'], 'backend')
             displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL
 
@@ -132,11 +139,11 @@ stages:
               versionSpec: $(DEFAULT_NODE_VERSION)
             displayName: "Setup Node.js"
 
-          - script: npm ci
+          - script: npm ci --ignore-scripts
             displayName: "Install dependencies" # Replace with INSTALL_CMD
 
           # Frontend/Fullstack only — skipped for backend-only stacks
-          - script: npx playwright install --with-deps chromium
+          - script: ./node_modules/.bin/playwright install --with-deps chromium
             condition: ne(variables['TEST_STACK_TYPE'], 'backend')
             displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL
 
diff --git a/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml b/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml
index 75ee46a7..4bb55fb8 100644
--- a/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml
+++ b/_bmad/tea/workflows/testarch/bmad-testarch-ci/azure-pipelines-template.yaml
@@ -4,10 +4,17 @@
 # Stack: {test_stack_type} | Framework: {test_framework}
 #
 # Variables to customize per project:
-#   INSTALL_CMD       - dependency install command (e.g., npm ci, pnpm install --frozen-lockfile)
+#   INSTALL_CMD       - dependency install command (e.g., npm ci --ignore-scripts, pnpm install --frozen-lockfile --ignore-scripts)
+#                       NOTE: --ignore-scripts skips ALL lifecycle scripts — both dependency scripts (preinstall/postinstall/prepare)
+#                       AND root-package hooks (SonarCloud S6505). For dependencies needing lifecycle scripts, add explicit
+#                       `npm rebuild <pkg>` steps. For root-package scripts (e.g., prepare hooks), run them as separate steps
+#                       (e.g., `npm run prepare` if needed for your stack).
 #   TEST_CMD          - main test command (e.g., npm run test:e2e, npm test, npx vitest)
 #   LINT_CMD          - lint command (e.g., npm run lint)
-#   BROWSER_INSTALL   - browser install command (frontend/fullstack only; omit for backend)
+#   BROWSER_INSTALL   - browser install command using the lockfile-pinned local binary; avoid npx,
+#                       which can resolve an unpinned copy from the npx cache or global bin
+#                       (e.g., ./node_modules/.bin/playwright install --with-deps chromium;
+#                       frontend/fullstack only; omit for backend)
 #   DEFAULT_NODE_VERSION - Node.js version (read from .nvmrc or default to 24)
 
 trigger:
@@ -51,7 +58,7 @@ stages:
               path: $(npm_config_cache)
             displayName: "Cache npm"
 
-          - script: npm ci
+          - script: npm ci --ignore-scripts
             displayName: "Install dependencies" # Replace with INSTALL_CMD
 
           - script: npm run lint
@@ -90,11 +97,11 @@ stages:
               path: $(npm_config_cache)
             displayName: "Cache npm"
 
-          - script: npm ci
+          - script: npm ci --ignore-scripts
             displayName: "Install dependencies" # Replace with INSTALL_CMD
 
           # Frontend/Fullstack only — skipped for backend-only stacks
-          - script: npx playwright install --with-deps chromium
+          - script: ./node_modules/.bin/playwright install --with-deps chromium
             condition: ne(variables['TEST_STACK_TYPE'], 'backend')
             displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL
 
@@ -132,11 +139,11 @@ stages:
               versionSpec: $(DEFAULT_NODE_VERSION)
             displayName: "Setup Node.js"
 
-          - script: npm ci
+          - script: npm ci --ignore-scripts
             displayName: "Install dependencies" # Replace with INSTALL_CMD
 
           # Frontend/Fullstack only — skipped for backend-only stacks
-          - script: npx playwright install --with-deps chromium
+          - script: ./node_modules/.bin/playwright install --with-deps chromium
             condition: ne(variables['TEST_STACK_TYPE'], 'backend')
             displayName: "Install Playwright browsers" # Replace with BROWSER_INSTALL